Junglewise Threat Intelligence

CVE-2026-31389: Linux Kernel use-after-free in SPI controller registration

CVE-2026-31389 · Severity: high · CVSS 7.8 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Serial Peripheral Interface (SPI) subsystem, which manages communication between the computer's processor and peripheral devices like sensors or flash memory. If a specific error occurs while setting up a new SPI controller, the system may fail to properly clean up internal resources, leading to a memory error. This could allow a local user to potentially crash the system or gain unauthorized access to sensitive information.

Technical details

A use-after-free vulnerability exists in the Linux kernel's SPI subsystem within the `spi_register_controller` function in `drivers/spi/spi.c`. The flaw is triggered when a per-cpu statistics allocation fails during the controller registration process; in this specific error path, the kernel fails to properly deregister the device from the driver core. This leads to a state where driver resources are freed but still referenced, or results in unclocked register accesses. An attacker with local access could exploit this to cause a denial of service (system crash) or potentially achieve privilege escalation. Patches have been released across multiple stable kernel branches to ensure proper cleanup via `device_del` in all failure paths.

Affected products

  • Linux Linux Kernel 6.0 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-12: other: Patch authored by Johan Hovold
  • 2026-03-25: patched: Patch committed to stable trees by Greg Kroah-Hartman
  • 2026-04-03: disclosed: CVE published by kernel.org
  • 2026-05-20: advisory: NVD enrichment and analysis completed

References

Related threats