CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()
Published Sep 24, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
spi: Add NULL check for spigetdeviceid() in spigetdevicematchdata()
Prevent NULL pointer dereference when spigetdeviceid() returns NULL, which can happen when using driveroverride without matching SPI ID entry.
Affected Software
1 affected component
Linux Linux kernel
Event History
Sep 24, 2026
CVE Published
via MITRE·04:03 PM
Data Sourced
via MITRE·04:03 PM
Description
Data Sourced
via NVD·05:17 PM
Description
Frequently Asked Questions
1
What systems are exposed to this issue?
Systems are exposed when an SPI device uses driver_override and the selected driver has no matching SPI ID entry. In that situation, spi_get_device_id() can return NULL during spi_get_device_match_data().
2
What is the impact if the vulnerable path is reached?
The vulnerable path can dereference a NULL pointer, which can cause a kernel fault.
3
How can the issue be mitigated before applying the fix?
Avoid using driver_override to bind an SPI device to a driver that does not have a matching SPI ID entry.