CVE-2026-45996: spi: imx: fix use-after-free on unbind
In the Linux kernel, the following vulnerability has been resolved:
spi: imx: fix use-after-free on unbind
The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed).
Take another reference before deregistering the controller so that the driver data is not freed until the driver is done with it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The vulnerability is rated with local attack vector, low attack complexity, low privileges required, and no user interaction. It is therefore relevant to systems where a low-privileged local user can interact with the affected kernel driver.
What is the expected security impact?
The CVSS vector indicates high impact to availability, with no reported confidentiality or integrity impact. Exploitation may cause a denial of service through the use-after-free condition.
When does the vulnerable condition occur?
The condition occurs during unbind and controller deregistration in the i.MX SPI driver. The SPI subsystem can free the controller and driver data during deregistration while the driver still uses that data.
Which products are identified as affected?
The affected software list identifies the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1. The issue is associated with the i.MX SPI driver.