Executive brief
A vulnerability in the Linux kernel's STM32 Octo-SPI driver could lead to a resource leak when the driver is removed or disabled. This occurs because the system fails to properly clean up internal components if a power management task fails. While primarily a technical stability issue, it could potentially be used to cause a denial-of-service condition on affected hardware.
Technical details
A resource leak exists in the stm32-ospi SPI driver within the Linux kernel. The remove() callback was implemented with an early return that triggered if pm_runtime_resume_and_get() failed. This logic caused the driver to skip essential cleanup steps, such as unregistering the SPI controller, when power management transitions failed. An attacker with local access could potentially exploit this to exhaust system resources or cause instability. The fix involves removing the early return to ensure cleanup code executes regardless of the power management resume result.
Affected products
- Linux Linux Kernel 6.15 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-05-01: disclosed
- 2026-05-01: advisory
- 2026-03-30: patched