Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-23475

spi: fix statistics allocation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: spi: fix statistics allocation The controller per-cpu statistics is not allocated until after the controller has been registered with driver core, which leaves a window where accessing the sysfs attributes can trigger a NULL-pointer dereference. Fix this by moving the statistics allocation to controller allocation while tying its lifetime to that of the controller (rather than using implicit devres).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to < 80c5bd0dca1cc5526ae0f4b273ccd163ed4caa4eaffected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to < f13100b1f5f111989f0750540a795fdef47492afaffected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to < df30056c78e8bead02d4be020199cabdbec0fef1affected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to < 378b295f67102eef78cf2c28105f60ae1dab5cc1affected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to < 118ce777d39f03cac99231196f820e4f998613a8affected
  • 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 to < dee0774bbb2abb172e9069ce5ffef579b12b3ae9affected

Linux Linux

Default version status: affected

  • 6.0affected
  • 0 to < 6.0unaffected
  • 6.1.167 to ≤ 6.1.*unaffected
  • 6.6.130 to ≤ 6.6.*unaffected
  • 6.12.78 to ≤ 6.12.*unaffected
  • 6.18.20 to ≤ 6.18.*unaffected
  • 6.19.10 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References