PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45996 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's SPI i.MX driver that triggers during device unbind operations. The SPI subsystem automatically frees the controller and driver data upon deregistration unless device-managed allocation is used. The fix takes an additional reference before deregistering the controller to ensure driver data remains valid until the driver completes its cleanup. This vulnerability affects systems using the SPI i.MX driver on unbind events, which could occur during driver removal, system shutdown, or hot-unplug scenarios. The vulnerability was resolved in the Linux kernel stable branches with commits addressing the reference counting issue.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

Organizations running Linux systems with i.MX SPI controllers, particularly embedded systems, industrial control systems, and IoT devices using NXP i.MX processors with SPI interfaces. System administrators maintaining kernel versions that include the SPI i.MX driver should prioritize updates.

Technical summary

The SPI i.MX driver in the Linux kernel contains a use-after-free vulnerability triggered during device unbind. The SPI subsystem frees controller and driver data during deregistration, but the driver may still access this data. The fix implements additional reference counting to extend the lifetime of driver data until the driver completes its unbind operations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits to affected systems
  • Verify running kernel version against patched versions in stable branches
  • Monitor for kernel updates from distribution vendors incorporating these fixes
  • Review systems using i.MX SPI controllers for potential exposure
  • Plan maintenance windows for kernel updates on affected embedded or industrial systems

Evidence notes

The vulnerability description indicates a use-after-free condition in the SPI i.MX driver during unbind operations. The fix involves proper reference counting to prevent premature freeing of driver data. Multiple stable kernel commits are referenced, indicating backports to supported kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45996 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45996

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45996 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45996

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/132e47030b0b5e398e0da6c59df5a5dae9b52cff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1c78c2002380a1fe31bfb01a3d5f29809e55a096

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/385a330083f8dd47c15b02e9a83aef9234a37003

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/aa9025a498036b6012769f7af36d421385386c17

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f99165ef067723221472ce1aff632bc74f562643

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.