PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45996 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's SPI i.MX driver that triggers during device unbind operations. The SPI subsystem automatically frees the controller and driver data upon deregistration unless device-managed allocation is used. The fix takes an additional reference before deregistering the controller to ensure driver data remains valid until the driver completes its cleanup. This vulnerability affects systems using the SPI i.MX driver on unbind events, which could occur during driver removal, system shutdown, or hot-unplug scenarios. The vulnerability was resolved in the Linux kernel stable branches with commits addressing the reference counting issue.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with i.MX SPI controllers, particularly embedded systems, industrial control systems, and IoT devices using NXP i.MX processors with SPI interfaces. System administrators maintaining kernel versions that include the SPI i.MX driver should prioritize updates.

Technical summary

The SPI i.MX driver in the Linux kernel contains a use-after-free vulnerability triggered during device unbind. The SPI subsystem frees controller and driver data during deregistration, but the driver may still access this data. The fix implements additional reference counting to extend the lifetime of driver data until the driver completes its unbind operations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits to affected systems
  • Verify running kernel version against patched versions in stable branches
  • Monitor for kernel updates from distribution vendors incorporating these fixes
  • Review systems using i.MX SPI controllers for potential exposure
  • Plan maintenance windows for kernel updates on affected embedded or industrial systems

Evidence notes

The vulnerability description indicates a use-after-free condition in the SPI i.MX driver during unbind operations. The fix involves proper reference counting to prevent premature freeing of driver data. Multiple stable kernel commits are referenced, indicating backports to supported kernel versions.

Official resources

2026-05-27