UBUNTU-CVE-2026-90410: Low severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: spi: davinci: switch to managed controller allocation The controller is allocated with the non-managed spiallochost() while the interrupt is registered with devmrequestthreadedirq(). During removal, spibitbangstop() only unregisters the controller; the subsequent spicontrollerput() then frees the controller together with its embedded davincispi devdata, which is the IRQ handler's devid. The devmrequestthreadedirq() release action (freeirq()), which drains the handler, does not run until after .remove() returns. A late or latched interrupt can therefore reach davincispiirq() and dereference already-freed memory. Switch to devmspiallochost() so that the devres LIFO order releases the controller only after freeirq() has drained the handler, and drop the now-redundant spicontrollerput() from .remove(). The probe error path is simplified to direct returns. The clock is acquired with devmclkgetenabled(), which is registered after the IRQ and thus released before it by the devres LIFO order. Drain the interrupt explicitly with devmfreeirq() before disabling the controller so that a late interrupt cannot access the registers of a clock-gated controller. This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the davinci SPI driver, allocate the controller with devm_spi_alloc_host() instead of spi_alloc_host(), rely on devres ordering so free_irq() drains the IRQ handler before the controller and its embedded devdata are released, and remove the redundant spi_controller_put() from .remove().