Executive brief
A vulnerability in the Linux kernel's Serial Peripheral Interface (SPI) subsystem could lead to resource leaks. When a new SPI device fails to set up correctly, the system may fail to release memory or other resources, potentially leading to system instability or performance degradation over time. This affects systems using SPI controllers, which are common in embedded and industrial computing environments.
Technical details
A resource leak exists in the Linux kernel SPI subsystem within the `drivers/spi/spi.c` component. The vulnerability occurs because `spi_setup()` does not consistently call the controller's `cleanup()` function if an error occurs during the initial device registration flow. Specifically, if `spi_set_cs_timing` or power management calls fail, the function returns an error code without freeing previously allocated resources. The fix introduces an internal `__spi_setup` function with an `initial_setup` flag to ensure `spi_cleanup` is invoked upon failure during device addition. This issue primarily impacts system stability and resource availability.
Affected products
- Linux Linux Kernel 5.13 and later
Timeline
- 2026-04-10: other: Patch authored by Johan Hovold
- 2026-05-27: disclosed: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/11baa8b24bcb07ae2048f2566a220021d766abe0
- https://git.kernel.org/stable/c/1e774294b2f944f59e03a04eb438768a4b93c3ce
- https://git.kernel.org/stable/c/a2c817c629430fbbd54273525b472dac96e2c8fd
- https://git.kernel.org/stable/c/db357034f7e0cf23f233f414a8508312dfe8fbbe
- https://git.kernel.org/stable/c/dbcead54b12468d9aa54c0e1f0042d838ec3b0ae