Use-After-Free Vulnerability in Linux Kernel Affecting Qualcomm SPI Controller

CVE-2025-39893

What is CVE-2025-39893?

A vulnerability has been identified in the Linux kernel affecting the Qualcomm SPI controller. The issue arises when the hardware ECC engine remains registered despite errors during the 'spi_register_controller()' function or after the device is removed. This oversight can lead to potential use-after-free scenarios, emphasizing the need for corrective measures in the 'qcom_spi_probe()' and 'qcom_spi_remove()' functions to unregister the engine appropriately. Ensuring proper registration and unregistration of the ECC engine is critical to maintaining system integrity and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References