In the Linux kernel, the following vulnerability has been resolved:

spi: fix use-after-free on controller registration failure

Make sure to deregister from driver core also in the unlikely event that
per-cpu statistics allocation fails during controller registration to
avoid use-after-free (of driver resources) and unclocked register
accesses.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < 0e23f50086da7d0b183dfeac26021acfcdee086b
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < 6bbd385b30c7fb6c7ee0669e9ada91490938c051
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < afe27c1f43aa57530011f419be6ddf71306565d2
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < 80f3e8cd2b4ad355b2ad2024cf423f6d183404f7
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < 23b51bad2eb8787aa74324cfccefb258515ae5ba
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < 8634e05b08ead636e926022f4a98416e13440df9
Linux Linux affected
Version Status Constraints
6.0 affected —
0 unaffected < 6.0
6.1.167 unaffected ≤ 6.1.*
6.6.130 unaffected ≤ 6.6.*
6.12.78 unaffected ≤ 6.12.*
6.18.20 unaffected ≤ 6.18.*
6.19.10 unaffected ≤ 6.19.*
7.0-rc5 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0e23f50086da7d0b183dfeac26021acfcdee086b cve-icon cve-icon
https://git.kernel.org/stable/c/23b51bad2eb8787aa74324cfccefb258515ae5ba cve-icon cve-icon
https://git.kernel.org/stable/c/6bbd385b30c7fb6c7ee0669e9ada91490938c051 cve-icon cve-icon
https://git.kernel.org/stable/c/80f3e8cd2b4ad355b2ad2024cf423f6d183404f7 cve-icon cve-icon
https://git.kernel.org/stable/c/8634e05b08ead636e926022f4a98416e13440df9 cve-icon cve-icon
https://git.kernel.org/stable/c/afe27c1f43aa57530011f419be6ddf71306565d2 cve-icon cve-icon
History

Fri, 03 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free on controller registration failure Make sure to deregister from driver core also in the unlikely event that per-cpu statistics allocation fails during controller registration to avoid use-after-free (of driver resources) and unclocked register accesses.
Title spi: fix use-after-free on controller registration failure
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-04-03T15:15:55.068Z

Reserved: 2026-03-09T15:48:24.084Z

Link: CVE-2026-31389

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-03T16:16:36.823

Modified: 2026-04-03T16:16:36.823

Link: CVE-2026-31389

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.