Executive brief
The Linux kernel's davinci SPI driver had a resource management defect that could cause a crash during device removal. When the driver is unloaded, a queued or late-arriving interrupt could trigger an IRQ handler that tries to access memory that has already been freed, leading to a kernel panic. This affects systems using the TI DaVinci SPI interface, primarily embedded devices and development boards.
Technical details
The davinci SPI driver allocated a controller using the non-managed spi_alloc_host() but registered its interrupt handler with the managed devm_request_threaded_irq(). During device removal, the controller was freed before the interrupt handler's deferred release action completed, creating a use-after-free condition. A late or latched interrupt could reach the interrupt handler davinci_spi_irq() and dereference the already-freed davinci_spi struct. The fix switches to devm_spi_alloc_host() to ensure proper devres LIFO ordering, where the controller is released only after free_irq() has drained the handler. Additionally, devm_free_irq() is explicitly called before clock disabling to prevent interrupts from accessing a clock-gated controller. The patch was developed through static analysis and applied to multiple kernel stable branches.
Affected products
- Linux Linux kernel multiple versions (2.6.11 through 7.2 and later)
Timeline
- 2026-09-17: disclosed: Public CVE assignment and advisory publication
- 2026-07-19: patched: Patch authored by Fan Wu and committed upstream
- 2026-09-14: other: Backported to stable kernel branches by Greg Kroah-Hartman