CVE-2026-46083

Analyzed Analyzed - Analysis Complete

SPI Resource Leak in Linux Kernel

Publication date: 2026-05-27

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: spi: fix resource leaks on device setup failure Make sure to call controller cleanup() if spi_setup() fails while registering a device to avoid leaking any resources allocated by setup().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-24

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46083

EUVD

EUVD-2026-32466

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	5.13
linux	linux_kernel	5.13
linux	linux_kernel	5.13
linux	linux_kernel	5.13
linux	linux_kernel	5.13
linux	linux_kernel	From 6.7 (inc) to 6.12.86 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.27 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 5.10.44 (inc) to 5.11 (exc)
linux	linux_kernel	From 5.12.11 (inc) to 5.13 (exc)
linux	linux_kernel	From 5.13.1 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 5.4.126 (inc) to 5.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is related to the Linux kernel's SPI (Serial Peripheral Interface) subsystem. It involves resource leaks that occur when the device setup process fails during spi_setup(). Specifically, if spi_setup() fails while registering a device, the controller cleanup() function is not called, which leads to allocated resources not being properly released.

Impact Analysis

The impact of this vulnerability is that it can cause resource leaks in the Linux kernel when SPI device setup fails. Resource leaks can lead to increased memory usage or other resource exhaustion, potentially degrading system performance or stability over time.

Mitigation Strategies

The vulnerability is fixed by ensuring that the controller cleanup() function is called if spi_setup() fails during device registration to avoid resource leaks.

To mitigate this vulnerability, update your Linux kernel to the version where this fix is applied.

Hi! I’m here to help you understand CVE-2026-46083. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70