Executive brief
A vulnerability was identified in the Linux kernel's Freescale SPI driver. This driver manages how the operating system communicates with certain hardware components. An error in how the driver shuts down could lead to a system crash or unpredictable behavior because it releases hardware resources while they are still being managed by the controller. This primarily affects system stability during hardware reconfiguration or driver updates.
Technical details
A resource management vulnerability exists in the Freescale SPI driver (spi-fsl-spi.c) within the Linux kernel. The driver was incorrectly using devm_spi_register_controller, which can lead to a race condition or use-after-free during driver unbinding because underlying resources like DMA (via fsl_spi_cpm_free) were being released before the controller was fully deregistered. An attacker with local administrative privileges could potentially trigger this by unbinding the driver, leading to a kernel oops or system instability. The fix involves manually calling spi_unregister_controller before freeing resources in the remove() path. This issue was introduced by a previous migration to devm_ functions.
Affected products
- Linux Linux kernel 4.3 and later
Timeline
- 2026-04-10: patched: Initial patch submitted by Johan Hovold
- 2026-05-28: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/562d954a144950ec2aa6a874ae657cb3fa31fe53
- https://git.kernel.org/stable/c/5750743a39c9d46ac9fcf57ffe000956da4942cf
- https://git.kernel.org/stable/c/9b7abfed4c3754062d1f3ffd452e65a38667f586
- https://git.kernel.org/stable/c/ca3195c7b88362d7c81efe685948663a9f9db0e6
- https://git.kernel.org/stable/c/e888308222375ac28bae69134dae288178718a96