CVE-2026-43460 Linux CVE debrief

Who should care

Kernel maintainers, Linux distribution security teams, and operators of embedded/ARM systems that include the Rockchip SFC SPI flash controller should care most. NVD rates the issue as HIGH (CVSS 7.8) with local, low-privilege conditions, so systems that expose the affected kernel path should be prioritized for patching.

Technical summary

NVD classifies the weakness as CWE-415 (double free) and marks the vulnerability as analyzed. The supplied description states that the driver used devm_spi_register_controller() for registration, which performs automatic cleanup on device removal, while remove() also called spi_unregister_controller(); that overlap can lead to a double-free. The fix is to switch probe() to spi_register_controller() so the controller is unregistered explicitly and before DMA buffer unmapping. NVD lists affected Linux kernel ranges including 6.14 through before 6.18.19, 6.19 through before 6.19.9, and the early 7.0 release candidates rc1 through rc3.

Defensive priority

High. This is a kernel memory-safety issue with potential integrity and availability impact, and NVD’s CVSS vector indicates local access with low privileges is sufficient. Patch affected kernels and backport the upstream fix on any downstream branch that carries the Rockchip SFC driver.

Recommended defensive actions

• Apply the upstream Linux kernel fix referenced by NVD for CVE-2026-43460.
• If you maintain downstream kernels, backport the change that replaces devm_spi_register_controller() with spi_register_controller() in the Rockchip SFC driver.
• Remove any redundant controller teardown path that could double-unregister the SPI controller during device removal.
• Inventory systems using the Rockchip SFC SPI controller and confirm whether they run kernels in the affected version ranges listed by NVD.
• After patching, validate that the affected driver path is present only in fixed builds and that your kernel package versions are updated across all fleets.

Evidence notes

The debrief is based only on the supplied CVE description and the official NVD record. NVD lists the weakness as CWE-415 and provides the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The record also includes three kernel patch references, and the supplied description explicitly explains the double-free mechanism and the registration/unregistration fix. Affected version ranges are taken from the NVD CPE criteria in the source item.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.