Executive brief
A vulnerability was identified in the Linux kernel's SPI communication driver for Amlogic Meson processors. This flaw could allow a local user to cause a system crash or potentially execute unauthorized code by triggering a memory management error during driver removal. This impacts the overall stability and security of devices using these specific hardware components.
Technical details
A double-put vulnerability (CWE-415) exists in the drivers/spi/spi-meson-spicc.c component of the Linux kernel. The meson_spicc_probe() function registers the SPI controller using devm_spi_register_controller(), which automatically handles reference counting and cleanup via the devres framework. However, the meson_spicc_remove() function explicitly calls spi_controller_put() (or spi_master_put() in older versions), leading to a second decrement of the reference counter when the device is removed. A local attacker with sufficient privileges to trigger driver removal could exploit this to cause memory corruption, leading to a denial of service (kernel panic) or potentially arbitrary code execution. The issue has been resolved by removing the redundant put call in the driver's remove path.
Affected products
- Linux Linux Kernel 4.14.244 to 4.15, 4.19.203 to 4.20, 5.4.140 to 5.5, 5.10.58 to 5.11, 5.13.10 to 5.14, 5.14.1 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11
Timeline
- 2026-04-22: disclosed
- 2026-04-22: advisory
- 2026-05-17: patched
References
- https://git.kernel.org/stable/c/0d645c6d13fa0597935d3d16b09a7ba5d24ed284
- https://git.kernel.org/stable/c/40ad0334c17b23d8b66b1082ad1478a6202e90e2
- https://git.kernel.org/stable/c/63542bb402b7013171c9f621c28b609eda4dbf1f
- https://git.kernel.org/stable/c/9b812ceb75a6260c17c91db4b9e74ead8cfa06f5
- https://git.kernel.org/stable/c/da06a104f0486355073ff0d1bcb1fcbebb7080d6