CVE-2026-31487
Use-After-Free Vulnerability in Linux Kernel SPI Driver Attachment
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.20 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 4.20.1 (inc) to 6.12.80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's SPI subsystem where the driver_override field is accessed without proper locking during the driver probing process. Specifically, when a driver is probed through __driver_attach(), the bus' match() callback is called without holding the device lock. This leads to a use-after-free (UAF) condition because the driver_override field is accessed without synchronization.
The issue is fixed by using the driver-core driver_override infrastructure, which manages proper locking internally to prevent the UAF.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel's SPI driver subsystem. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if they can exploit the timing of the driver probing process.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in the Linux kernel related to the spi driver and driver_override infrastructure has been resolved by proper locking mechanisms internally in the driver-core driver_override infrastructure.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.