Riskcovery

CVE-2026-23475

spi: fix statistics allocation

State
Published
Severity
Not scored
Published
Apr 3, 2026
Updated
Oct 15, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: fix statistics allocation

The controller per-cpu statistics is not allocated until after the controller has been registered with driver core, which leaves a window where accessing the sysfs attributes can trigger a NULL-pointer dereference.

Fix this by moving the statistics allocation to controller allocation while tying its lifetime to that of the controller (rather than using implicit devres).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to before 80c5bd0dca1cc5526ae0f4b273ccd163ed4caa4eAffected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to before f13100b1f5f111989f0750540a795fdef47492afAffected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to before df30056c78e8bead02d4be020199cabdbec0fef1Affected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to before 378b295f67102eef78cf2c28105f60ae1dab5cc1Affected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to before 118ce777d39f03cac99231196f820e4f998613a8Affected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to before dee0774bbb2abb172e9069ce5ffef579b12b3ae9Affected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.1.167 through 6.1.*Not affected
  • 6.6.130 through 6.6.*Not affected
  • 6.12.78 through 6.12.*Not affected
  • 6.18.20 through 6.18.*Not affected
  • 6.19.10 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.