Junglewise Threat Intelligence

CVE-2026-90410: Linux kernel davinci SPI use-after-free on driver removal

CVE-2026-90410 · Severity: info · CVSS 5.5 · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's davinci SPI driver had a resource management defect that could cause a crash during device removal. When the driver is unloaded, a queued or late-arriving interrupt could trigger an IRQ handler that tries to access memory that has already been freed, leading to a kernel panic. This affects systems using the TI DaVinci SPI interface, primarily embedded devices and development boards.

Technical details

The davinci SPI driver allocated a controller using the non-managed spi_alloc_host() but registered its interrupt handler with the managed devm_request_threaded_irq(). During device removal, the controller was freed before the interrupt handler's deferred release action completed, creating a use-after-free condition. A late or latched interrupt could reach the interrupt handler davinci_spi_irq() and dereference the already-freed davinci_spi struct. The fix switches to devm_spi_alloc_host() to ensure proper devres LIFO ordering, where the controller is released only after free_irq() has drained the handler. Additionally, devm_free_irq() is explicitly called before clock disabling to prevent interrupts from accessing a clock-gated controller. The patch was developed through static analysis and applied to multiple kernel stable branches.

Affected products

  • Linux Linux kernel multiple versions (2.6.11 through 7.2 and later)

Timeline

  • 2026-09-17: disclosed: Public CVE assignment and advisory publication
  • 2026-07-19: patched: Patch authored by Fan Wu and committed upstream
  • 2026-09-14: other: Backported to stable kernel branches by Greg Kroah-Hartman

References

Related threats