CVE-2026-31485: spi: spi-fsl-lpspi: fix teardown order issue (UAF)
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
There is a teardown order issue in the driver. The SPI controller is registered using devmspiregistercontroller(), which delays unregistration of the SPI controller until after the fsllpspiremove() function returns.
As the fsllpspiremove() function synchronously tears down the DMA channels, a running SPI transfer triggers the following NULL pointer dereference due to use after free:
| fsllpspi 42550000.spi: I/O Error in DMA RX | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] | Call trace: | fsllpspidmatransfer+0x260/0x340 [spifsllpspi] | fsllpspitransferone+0x198/0x448 [spifsllpspi] | spitransferonemessage+0x49c/0x7c8 | spipumptransfermessage+0x120/0x420 | spisync+0x2c4/0x520 | spisync+0x34/0x60 | spidevmessage+0x20c/0x378 [spidev] | spidevioctl+0x398/0x750 [spidev] [...]
Switch from devmspiregistercontroller() to spiregistercontroller() in fsllpspiprobe() and add the corresponding spiunregistercontroller() in fsllpspiremove().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel SPI driver: spi-fsl-lpspito a version that resolves this vulnerability.Patch spi: spi-fsl-lpspi: fix teardown order issue (UAF)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31485?
CVE-2026-31485 has a medium severity rating due to its potential for causing user-after-free (UAF) conditions in the Linux kernel.
How do I fix CVE-2026-31485?
To fix CVE-2026-31485, update your Linux kernel to a patched version that addresses the teardown order issue in the spi-fsl-lpspi driver.
Which Linux kernel versions are affected by CVE-2026-31485?
CVE-2026-31485 affects multiple Linux kernel versions ranging from 4.10.1 up to 7.0-rc7, depending on the specific distribution.
What is the impact of CVE-2026-31485 on system security?
The impact of CVE-2026-31485 can lead to system instability and potential loss of data integrity due to the user-after-free vulnerability.
Is CVE-2026-31485 present in all Linux installations?
No, CVE-2026-31485 is not present in all Linux installations; it specifically affects systems utilizing the spi-fsl-lpspi driver.