Use-After-Free Vulnerability in Linux Kernel Affecting SPI Drivers

CVE-2026-31487

What is CVE-2026-31487?

A vulnerability exists in the Linux kernel's handling of SPI drivers. When a driver is probed via the __driver_attach() function, the bus' match() callback gets invoked without the requisite device lock, which allows for access to the driver_override field without proper synchronization. This situation can trigger a Use-After-Free (UAF) condition. The resolution involves utilizing the driver-core driver_override framework, ensuring that internal locking mechanisms are properly managed. It should be noted that the default behavior of SPI differs from other bus types, as it will output an empty string rather than a direct null representation when the driver_override pointer is null.

References