UBUNTU-CVE-2026-90433: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost() while the interrupt is registered with devmrequestirq(). During removal, spibitbangstop() only unregisters the controller; the subsequent spicontrollerput() then frees the controller together with its embedded driver-private devdata, which is the IRQ handler's devid. The devmrequestirq() release action (freeirq()), which drains the handler, does not run until after .remove() returns. A late or latched interrupt can therefore reach tinyspiirq() and dereference already-freed memory (e.g. hw->base). Switch to devmspiallochost() so that the devres LIFO order releases the controller only after freeirq() has drained the handler, and drop the now-redundant spicontrollerput() from .remove(). The probe error path is simplified to direct returns. This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the oc-tiny SPI controller driver in the listed Ubuntu kernel packages, including linux, linux-fips, and the AWS, Azure, and GCP kernel variants. Systems without hardware using the oc-tiny SPI controller driver are not described as exposed by the available data.
What condition is required to trigger the use-after-free?
The controller must be removed while its interrupt handler is still registered, and a late or latched interrupt must occur after the controller and its driver-private data have been freed. That interrupt can enter tiny_spi_irq() and dereference freed memory.
Is the issue associated with normal controller removal rather than ordinary SPI operation?
Yes. The described vulnerable sequence occurs during driver removal because the IRQ cleanup action runs only after the remove callback returns, while the controller could be freed during that callback.
What does the fix change to prevent the issue?
The fix allocates the SPI controller with devm_spi_alloc_host() so managed-resource cleanup releases the IRQ and drains its handler before freeing the controller. It also removes the redundant spi_controller_put() call from the remove path.