Linux Kernel Device Management Vulnerability in SPI Controller

CVE-2022-50190

What is CVE-2022-50190?

A vulnerability in the device management of the Linux kernel affects SPI controllers, specifically when there is a failure in the devm_add_action_or_reset() function. This leads to an incorrect reference count decrement in the spi_unregister function, which can cause a use-after-free condition when error handling routines attempt to access released control structures. This issue may allow attackers to exploit memory management mistakes, potentially leading to arbitrary code execution or system instability.

References