CVE-2026-23068

Summary

In the Linux kernel, the following vulnerability has been resolved:

spi: spi-sprd-adi: Fix double free in probe error path

The driver currently uses spi_alloc_host() to allocate the controller but registers it using devm_spi_register_controller().

If devm_register_restart_handler() fails, the code jumps to the put_ctlr label and calls spi_controller_put(). However, since the controller was registered via a devm function, the device core will automatically call spi_controller_put() again when the probe fails. This results in a double-free of the spi_controller structure.

Fix this by switching to devm_spi_alloc_host() and removing the manual spi_controller_put() call.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxac1775012058e13ef1522938e27f5973d9e3f053 < bddd3d10d039729b81cfb0804520c8832a701a0eaffected
LinuxLinuxac1775012058e13ef1522938e27f5973d9e3f053 < 417cdfd9b9f986e95bfcb1d68eb443e6e0a15f8caffected
LinuxLinuxac1775012058e13ef1522938e27f5973d9e3f053 < 346775f2b4cf839177e8e86b94aa180a06dc15b0affected
LinuxLinuxac1775012058e13ef1522938e27f5973d9e3f053 < f6d6b3f172df118db582fe5ec43ae223a55d99cfaffected
LinuxLinuxac1775012058e13ef1522938e27f5973d9e3f053 < 383d4f5cffcc8df930d95b06518a9d25a6d74aacaffected
LinuxLinux4.17affected
LinuxLinux0 < 4.17unaffected
LinuxLinux6.1.162 <= 6.1.*unaffected
LinuxLinux6.6.122 <= 6.6.*unaffected
LinuxLinux6.12.68 <= 6.12.*unaffected
LinuxLinux6.18.8 <= 6.18.*unaffected
LinuxLinux6.19 <= *unaffected

Weaknesses

References