CVE-2026-31487
Received Received - Intake
Use-After-Free Vulnerability in Linux Kernel SPI Driver Attachment

Publication date: 2026-04-22

Last updated on: 2026-04-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: spi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Also note that we do not enable the driver_override feature of struct bus_type, as SPI - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n".
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-22
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-04-22
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31487
EUVD
EUVD-2026-24853
Affected Vendors & Products
Showing 11 associated CPEs
Vendor Product Version / Range
linux linux_kernel 4.20
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.21 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.11 (exc)
linux linux_kernel From 4.20.1 (inc) to 6.12.80 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The vulnerability in the Linux kernel related to the spi driver and driver_override infrastructure has been resolved by proper locking mechanisms internally in the driver-core driver_override infrastructure.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Executive Summary

This vulnerability exists in the Linux kernel's SPI subsystem where the driver_override field is accessed without proper locking during the driver probing process. Specifically, when a driver is probed through __driver_attach(), the bus' match() callback is called without holding the device lock. This leads to a use-after-free (UAF) condition because the driver_override field is accessed without synchronization.

The issue is fixed by using the driver-core driver_override infrastructure, which manages proper locking internally to prevent the UAF.

Impact Analysis

This vulnerability can lead to a use-after-free condition in the Linux kernel's SPI driver subsystem. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if they can exploit the timing of the driver probing process.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart