CVE-2026-23068
Unknown Unknown - Not Provided
Double Free Vulnerability in Linux spi-sprd-adi Driver

Publication date: 2026-02-04

Last updated on: 2026-03-13

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: spi: spi-sprd-adi: Fix double free in probe error path The driver currently uses spi_alloc_host() to allocate the controller but registers it using devm_spi_register_controller(). If devm_register_restart_handler() fails, the code jumps to the put_ctlr label and calls spi_controller_put(). However, since the controller was registered via a devm function, the device core will automatically call spi_controller_put() again when the probe fails. This results in a double-free of the spi_controller structure. Fix this by switching to devm_spi_alloc_host() and removing the manual spi_controller_put() call.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-04
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23068
Affected Vendors & Products
Showing 10 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 6.2 (inc) to 6.6.122 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.68 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.8 (exc)
linux linux_kernel 6.19
linux linux_kernel From 4.17 (inc) to 6.1.162 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a double-free issue in the Linux kernel's spi-sprd-adi driver. The driver allocates a controller using spi_alloc_host() but registers it with devm_spi_register_controller(). If devm_register_restart_handler() fails, the code manually frees the controller with spi_controller_put(). However, because the controller was registered with a devm function, the device core will also automatically free it when the probe fails. This causes the spi_controller structure to be freed twice, leading to a double-free vulnerability.

The fix involved switching to devm_spi_alloc_host() for allocation and removing the manual call to spi_controller_put(), preventing the double-free.

Impact Analysis

A double-free vulnerability can lead to undefined behavior such as memory corruption, system crashes, or potential exploitation by attackers to execute arbitrary code or escalate privileges. In this case, the double-free in the spi-sprd-adi driver could destabilize the Linux kernel, potentially affecting system reliability and security.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the spi-sprd-adi driver uses devm_spi_alloc_host() instead of spi_alloc_host(), and the manual spi_controller_put() call in the probe error path has been removed. This prevents the double-free issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23068. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart