CVE-2026-46228: spi: ch341: fix devres lifetime
In the Linux kernel, the following vulnerability has been resolved:
spi: ch341: fix devres lifetime
USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes).
Fix the controller and driver data lifetime so that they are released on driver unbind.
Note that this also makes sure that the SPI controller is placed correctly under the USB interface in the device tree.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch spi: ch341: fix devres lifetime - Operational
Apply the kernel patch 'spi: ch341: fix devres lifetime' or upgrade the Linux kernel to a release that contains this commit so the ch341 SPI controller/driver devres lifetime is fixed and resources are released on driver unbind.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46228?
The severity of CVE-2026-46228 is rated at 12, indicating a critical risk level.
What does CVE-2026-46228 address?
CVE-2026-46228 addresses issues with the devres lifetime in the spi: ch341 USB driver, tying device-managed resources to the USB interface.
How do I fix CVE-2026-46228?
To fix CVE-2026-46228, upgrade to the latest version of the Linux kernel that includes the patch for this vulnerability.
Which Linux kernel version is affected by CVE-2026-46228?
CVE-2026-46228 affects the Linux kernel specifically in the context of the spi: ch341 driver.
Is CVE-2026-46228 related to memory leaks?
Yes, CVE-2026-46228 resolves memory leak issues resulting from improper devres management in USB drivers.