Executive brief
The OpenCores tiny SPI driver in the Linux kernel had a memory management flaw where the SPI controller was freed before interrupt handlers could safely drain, creating a window where late interrupts could access already-freed memory. This could cause kernel crashes or undefined behavior on systems using this SPI controller driver during shutdown or error recovery.
Technical details
A use-after-free vulnerability existed in the spi-oc-tiny driver due to mismatched resource allocation and deallocation order. The SPI controller was allocated with non-managed spi_alloc_host() while interrupts were registered with the managed devm_request_irq(). During device removal, the controller was freed via spi_controller_put() before the devm cleanup actions ran, allowing late or latched interrupts to dereference freed memory (hw->base). The fix switches to managed allocation (devm_spi_alloc_host()) so the LIFO devres cleanup order ensures free_irq() drains the handler before the controller is freed. The vulnerability could be triggered during device removal or probe error paths on any system with this SPI controller, requiring no special privileges.
Affected products
- Linux Linux kernel all versions with spi-oc-tiny driver (since 2.6.38)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-07-19: patched: Upstream fix committed by Fan Wu