Junglewise Threat Intelligence

CVE-2026-43460: Linux Kernel Rockchip SFC double-free in remove callback

CVE-2026-43460 · Severity: high · CVSS 7.8 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Rockchip Serial Flash Controller (SFC) driver. This flaw could allow a local user to cause a system crash or potentially execute unauthorized code when the driver is removed or the hardware is disconnected. The issue stems from a memory management error where the system attempts to release the same resource twice.

Technical details

A double-free vulnerability exists in the 'spi-rockchip-sfc' driver within the Linux kernel. The driver incorrectly utilized 'devm_spi_register_controller()' during initialization while also manually calling 'spi_unregister_controller()' during the 'remove()' callback. Because the 'devm' variant automatically handles unregistration, the manual call results in a double-free of the controller structure. Additionally, the fix involves switching to 'spi_register_controller()' to ensure proper ordering between controller unregistration and DMA buffer unmapping. This issue is local in nature and typically triggered during driver detachment or module unloading.

Affected products

  • Linux Linux Kernel Rockchip SFC driver

Timeline

  • 2026-03-10: patched: Initial patch submitted by Felix Gu
  • 2026-05-08: disclosed: CVE-2026-43460 published

References

Related threats