CVE-2026-23431
Memory Leak in Linux amlogic-spisg SPI Driver Fixed
Publication date: 2026-04-03
Last updated on: 2026-04-23
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.10 (exc) |
| linux | linux_kernel | From 6.17.1 (inc) to 6.18.20 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's amlogic-spisg driver. Specifically, in the aml_spisg_probe() function, memory is allocated for the controller using spi_alloc_target() or spi_alloc_host(), but in some error cases, the allocated memory is not properly released because spi_controller_put() is not called. This causes the system to leak memory whenever the driver fails to initialize after allocation. The fix involves switching to devm_spi_alloc_host() and devm_spi_alloc_target(), which manage memory automatically and prevent the leak.
How can this vulnerability impact me? :
The impact of this vulnerability is a memory leak in the Linux kernel when the amlogic-spisg driver fails to probe correctly. Over time, repeated failures to initialize the driver could cause the system to consume increasing amounts of memory, potentially leading to degraded system performance or instability due to exhausted memory resources.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a memory leak in the aml_spisg_probe() function of the amlogic-spisg driver in the Linux kernel. It is fixed by converting the allocation calls to use devm_spi_alloc_host() and devm_spi_alloc_target() instead of spi_alloc_target()/spi_alloc_host().
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.