Use After Free Vulnerability in Linux Kernel SPI Controller by Vendor

CVE-2026-31485

What is CVE-2026-31485?

A vulnerability exists in the Linux kernel related to the SPI controller implementation. The issue arises from an improper teardown order in the driver, specifically due to the delayed unregistration of the SPI controller when using devm_spi_register_controller(). This flaw can lead to a use after free scenario; if a SPI transfer is active while the DMA channels are being torn down synchronously, it may result in a NULL pointer dereference. The resolution involves switching to spi_register_controller() for proper handling during registration and unregistering the controller correctly during the removal process.

References