Use-After-Free Vulnerability in Linux Kernel Affecting Qualcomm SPI Controller

CVE-2025-39893

What is CVE-2025-39893?

A vulnerability has been identified in the Linux kernel affecting the Qualcomm SPI controller. The issue arises when the hardware ECC engine remains registered despite errors during the 'spi_register_controller()' function or after the device is removed. This oversight can lead to potential use-after-free scenarios, emphasizing the need for corrective measures in the 'qcom_spi_probe()' and 'qcom_spi_remove()' functions to unregister the engine appropriately. Ensuring proper registration and unregistration of the ECC engine is critical to maintaining system integrity and security.

References