Executive brief
A vulnerability was identified in the Linux kernel's Rockchip Serial Flash Controller (SFC) driver. This flaw could allow a local user to cause a system crash or potentially execute unauthorized code when the driver is removed or the hardware is disconnected. The issue stems from a memory management error where the system attempts to release the same resource twice.
Technical details
A double-free vulnerability exists in the 'spi-rockchip-sfc' driver within the Linux kernel. The driver incorrectly utilized 'devm_spi_register_controller()' during initialization while also manually calling 'spi_unregister_controller()' during the 'remove()' callback. Because the 'devm' variant automatically handles unregistration, the manual call results in a double-free of the controller structure. Additionally, the fix involves switching to 'spi_register_controller()' to ensure proper ordering between controller unregistration and DMA buffer unmapping. This issue is local in nature and typically triggered during driver detachment or module unloading.
Affected products
- Linux Linux Kernel Rockchip SFC driver
Timeline
- 2026-03-10: patched: Initial patch submitted by Felix Gu
- 2026-05-08: disclosed: CVE-2026-43460 published