CVE-2026-31487: spi: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved:
spi: use generic driveroverride infrastructure
When a driver is probed through driverattach(), the bus' match() callback is called without the device lock held, thus accessing the driveroverride field without a lock, which can cause a UAF.
Fix this by using the driver-core driveroverride infrastructure taking care of proper locking internally.
Note that calling match() from driverattach() without the device lock held is intentional. [1]
Also note that we do not enable the driveroverride feature of struct bustype, as SPI - in contrast to most other buses - passes "" to sysfsemit() when the driveroverride pointer is NULL. Thus, printing "\n" instead of "(null)\n".
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31487?
CVE-2026-31487 is classified as a moderate severity vulnerability.
How do I fix CVE-2026-31487?
To fix CVE-2026-31487, update your Linux kernel to the latest version provided by your distribution.
What systems are affected by CVE-2026-31487?
CVE-2026-31487 affects the Linux kernel across various distributions.
What type of vulnerability is CVE-2026-31487?
CVE-2026-31487 is a race condition vulnerability in the Linux kernel's SPI driver.
Is CVE-2026-31487 exploitable?
Yes, CVE-2026-31487 can be exploited by attackers with local access to the system.