PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46083 Linux CVE debrief

A resource leak vulnerability in the Linux kernel's SPI subsystem could allow resource exhaustion when device registration fails. The flaw occurs in spi_setup() during device registration, where controller cleanup() was not invoked on setup failure, leading to leaked resources allocated by setup(). The fix ensures proper cleanup path execution when registration fails.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux system administrators, embedded systems developers using SPI devices, kernel maintainers, and organizations running custom kernel builds with SPI device support

Technical summary

The vulnerability exists in the Linux kernel's Serial Peripheral Interface (SPI) subsystem. When spi_setup() fails during device registration, the controller's cleanup() callback was not invoked, causing resources allocated by setup() to leak. The resolution adds proper cleanup invocation on setup failure paths. Multiple stable kernel branches received backported fixes.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version against patched stable releases (5.4, 5.10, 5.15, 6.1, 6.6, 6.12 per kernel.org stable commits)
  • Monitor NVD for CVSS score assignment as vulnerability remains in 'Awaiting Analysis' status
  • Assess SPI device registration failure handling in custom kernel modules
  • Apply stable kernel updates when available through distribution channels

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Fix confirmed via kernel.org stable tree commits. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis). Vendor identification marked low confidence by source system due to 'Unknown Vendor' classification with 'Kernel' as domain candidate.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46083 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46083

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46083 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46083

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/11baa8b24bcb07ae2048f2566a220021d766abe0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1e774294b2f944f59e03a04eb438768a4b93c3ce

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a2c817c629430fbbd54273525b472dac96e2c8fd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/db357034f7e0cf23f233f414a8508312dfe8fbbe

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dbcead54b12468d9aa54c0e1f0042d838ec3b0ae

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.