Executive brief
A vulnerability was identified in the Linux kernel's SPI driver for MPC52xx processors. This issue occurs when the driver is being removed or shut down, potentially leading to a system crash or unstable behavior because hardware resources are released before the software is finished using them. While primarily a stability issue, it could impact the availability of systems using this specific hardware architecture.
Technical details
A race condition or use-after-free vulnerability exists in the `mpc52xx_spi_remove` function within `drivers/spi/spi-mpc52xx.c`. The driver was incorrectly releasing underlying resources, such as interrupts and GPIOs, before deregistering the SPI controller. This improper teardown sequence allows the controller to remain active and potentially attempt to access freed resources or trigger interrupts that no longer have valid handlers. The fix reorders the teardown process to ensure `spi_unregister_controller` and `cancel_work_sync` are called before resource release.
Affected products
- Linux Linux Kernel 2.6.33 and later
Timeline
- 2026-04-14: patched: Initial patch authored by Johan Hovold
- 2026-05-28: disclosed: CVE-2026-46200 published