CVE-2026-90433: spi: oc-tiny: switch to managed controller allocation
In the Linux kernel, the following vulnerability has been resolved:
spi: oc-tiny: switch to managed controller allocation
The controller is allocated with the non-managed spiallochost() while the interrupt is registered with devmrequestirq(). During removal, spibitbangstop() only unregisters the controller; the subsequent spicontrollerput() then frees the controller together with its embedded driver-private devdata, which is the IRQ handler's devid. The devmrequestirq() release action (freeirq()), which drains the handler, does not run until after .remove() returns. A late or latched interrupt can therefore reach tinyspiirq() and dereference already-freed memory (e.g. hw->base).
Switch to devmspiallochost() so that the devres LIFO order releases the controller only after freeirq() has drained the handler, and drop the now-redundant spicontrollerput() from .remove(). The probe error path is simplified to direct returns.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
When can this flaw be triggered?
It can be triggered during driver removal if a late or latched interrupt reaches the oc-tiny SPI IRQ handler after the SPI controller and its driver-private data have been freed.
What systems are exposed?
Systems using the Linux kernel oc-tiny SPI driver are exposed when that driver is removed while its interrupt can still be delivered. The issue is tied to the driver's controller allocation and IRQ cleanup ordering.
What is the consequence of a successful trigger?
The IRQ handler can dereference freed driver-private memory, including the hardware base pointer. This is a use-after-free condition in the kernel.
What change resolves the cleanup ordering problem?
The resolved implementation allocates the SPI controller with managed allocation so that the managed IRQ release action drains the handler before the controller is released. It also removes the explicit controller put operation from the remove path.