Linux Kernel Vulnerability in SPI Controller by Vendor

CVE-2026-31489

What is CVE-2026-31489?

A resource management issue has been identified in the Linux kernel's SPI controller subsystem, specifically relating to the meson-spicc driver. The vulnerability arises from a double reference decrement when removing the SPI controller, resulting in an inadvertent double-put error. This happens because meson_spicc_probe() registers the controller using devm_spi_register_controller(), which automatically manages controller references. However, an additional call to spi_controller_put() in meson_spicc_remove() can lead to resource mismanagement, potentially causing crashes or stability issues in the kernel.

References