spi: rspi Controller Deregistration Flaw in Linux Kernel

Publication date: 2026-05-28

Last updated on: 2026-06-10

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: spi: rspi: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-10

Generated

2026-07-08

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46225

EUVD

EUVD-2026-32852

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.32 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.90 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.9 (exc)
linux	linux_kernel	From 3.14 (inc) to 6.6.140 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Impact Analysis

Improper deregistration of the SPI controller before releasing resources like DMA could potentially cause system instability or resource conflicts. This might lead to crashes or unexpected behavior in systems relying on the affected driver.

Executive Summary

This vulnerability relates to the Linux kernel's SPI (Serial Peripheral Interface) driver, specifically the rspi controller. The issue was that the controller was not properly deregistered before releasing underlying resources such as DMA (Direct Memory Access) during the driver unbind process. This could lead to improper resource management.

Hi! I’m here to help you understand CVE-2026-46225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70