CVE-2026-23068
Double Free Vulnerability in Linux spi-sprd-adi Driver
Publication date: 2026-02-04
Last updated on: 2026-03-13
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.122 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.68 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.8 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 4.17 (inc) to 6.1.162 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-415 | The product calls free() twice on the same memory address. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a double-free issue in the Linux kernel's spi-sprd-adi driver. The driver allocates a controller using spi_alloc_host() but registers it with devm_spi_register_controller(). If devm_register_restart_handler() fails, the code manually frees the controller with spi_controller_put(). However, because the controller was registered with a devm function, the device core will also automatically free it when the probe fails. This causes the spi_controller structure to be freed twice, leading to a double-free vulnerability.
The fix involved switching to devm_spi_alloc_host() for allocation and removing the manual call to spi_controller_put(), preventing the double-free.
How can this vulnerability impact me? :
A double-free vulnerability can lead to undefined behavior such as memory corruption, system crashes, or potential exploitation by attackers to execute arbitrary code or escalate privileges. In this case, the double-free in the spi-sprd-adi driver could destabilize the Linux kernel, potentially affecting system reliability and security.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the spi-sprd-adi driver uses devm_spi_alloc_host() instead of spi_alloc_host(), and the manual spi_controller_put() call in the probe error path has been removed. This prevents the double-free issue.