Executive brief
A vulnerability was identified in the Linux kernel's SPI (Serial Peripheral Interface) driver for Renesas controllers. The issue occurs when the driver is unloaded, potentially leading to a system crash or instability because hardware resources are released in the wrong order. This primarily affects system reliability during maintenance or hardware reconfiguration.
Technical details
A race condition or resource management error exists in the Renesas Serial Peripheral Interface (RSPI) driver (drivers/spi/spi-rspi.c) within the Linux kernel. The 'rspi_remove' function was releasing underlying DMA resources before unregistering the SPI controller. This improper teardown sequence can lead to a use-after-free or invalid memory access if the controller attempts to use those resources after they have been freed. The fix involves explicitly calling 'spi_unregister_controller' before 'rspi_release_dma' and managing the controller's reference count during the removal process. This issue was introduced by the transition to managed device registration (devm).
Affected products
- Linux Linux Kernel 3.14 and later
Timeline
- 2026-04-10: patched: Initial patch authored by Johan Hovold
- 2026-05-28: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/77defd64b405b680db73d767313fce770d368368
- https://git.kernel.org/stable/c/9944fa6726afb1e6eb7e2212764e7da0c97f2dcc
- https://git.kernel.org/stable/c/aee76c1dd189562c6678313caec12761f78a9ef3
- https://git.kernel.org/stable/c/c5090db1b31de3ef4db0cda7e822ab49cb572292
- https://git.kernel.org/stable/c/fee6abd9845c3edd217b0e429d09f764f9a5690e