Junglewise Threat Intelligence

CVE-2026-31489: Linux Kernel double-put in meson-spicc SPI driver

CVE-2026-31489 · Severity: high · CVSS 7.8 · Published 2026-04-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's SPI communication driver for Amlogic Meson processors. This flaw could allow a local user to cause a system crash or potentially execute unauthorized code by triggering a memory management error during driver removal. This impacts the overall stability and security of devices using these specific hardware components.

Technical details

A double-put vulnerability (CWE-415) exists in the drivers/spi/spi-meson-spicc.c component of the Linux kernel. The meson_spicc_probe() function registers the SPI controller using devm_spi_register_controller(), which automatically handles reference counting and cleanup via the devres framework. However, the meson_spicc_remove() function explicitly calls spi_controller_put() (or spi_master_put() in older versions), leading to a second decrement of the reference counter when the device is removed. A local attacker with sufficient privileges to trigger driver removal could exploit this to cause memory corruption, leading to a denial of service (kernel panic) or potentially arbitrary code execution. The issue has been resolved by removing the redundant put call in the driver's remove path.

Affected products

  • Linux Linux Kernel 4.14.244 to 4.15, 4.19.203 to 4.20, 5.4.140 to 5.5, 5.10.58 to 5.11, 5.13.10 to 5.14, 5.14.1 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11

Timeline

  • 2026-04-22: disclosed
  • 2026-04-22: advisory
  • 2026-05-17: patched

References

Related threats