CVE-2026-31487
Use-After-Free Vulnerability in Linux Kernel SPI Driver Attachment
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.20 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 4.20.1 (inc) to 6.12.80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in the Linux kernel related to the spi driver and driver_override infrastructure has been resolved by proper locking mechanisms internally in the driver-core driver_override infrastructure.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's SPI subsystem where the driver_override field is accessed without proper locking during the driver probing process. Specifically, when a driver is probed through __driver_attach(), the bus' match() callback is called without holding the device lock. This leads to a use-after-free (UAF) condition because the driver_override field is accessed without synchronization.
The issue is fixed by using the driver-core driver_override infrastructure, which manages proper locking internally to prevent the UAF.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel's SPI driver subsystem. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if they can exploit the timing of the driver probing process.