CVE-2026-46296

Received Received - Intake

NULL Pointer Dereference in Linux Kernel SPI Driver

Publication date: 2026-06-08

Last updated on: 2026-06-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: spi: s3c64xx: fix NULL-deref on driver unbind A change moving DMA channel allocation from probe() back to s3c64xx_spi_prepare_transfer() failed to remove the corresponding deallocation from remove(). Drop the bogus DMA channel release from remove() to avoid triggering a NULL-pointer dereference on driver unbind. This issue was flagged by Sashiko when reviewing a controller deregistration fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-08

Last Modified

2026-06-19

Generated

2026-06-29

AI Q&A

2026-06-08

EPSS Evaluated

2026-06-27

NVD

CVE-2026-46296

EUVD

EUVD-2026-35162

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Mitigation Strategies

The vulnerability is fixed by dropping the bogus DMA channel release from the remove() function in the s3c64xx SPI driver to avoid a NULL-pointer dereference on driver unbind.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Executive Summary

This vulnerability is a NULL-pointer dereference issue in the Linux kernel's spi: s3c64xx driver. It occurred because a change that moved DMA channel allocation from the probe() function back to s3c64xx_spi_prepare_transfer() did not remove the corresponding deallocation from the remove() function. As a result, when the driver is unbound, the remove() function attempts to release a DMA channel that may not have been allocated, causing a NULL-pointer dereference.

Impact Analysis

The impact of this vulnerability is that it can cause a NULL-pointer dereference when the driver is unbound, which typically leads to a kernel crash or system instability. This can result in denial of service conditions on affected systems running the vulnerable Linux kernel.

Hi! I’m here to help you understand CVE-2026-46296. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70