PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46083 Linux CVE debrief

A resource leak vulnerability in the Linux kernel's SPI subsystem could allow resource exhaustion when device registration fails. The flaw occurs in spi_setup() during device registration, where controller cleanup() was not invoked on setup failure, leading to leaked resources allocated by setup(). The fix ensures proper cleanup path execution when registration fails.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators, embedded systems developers using SPI devices, kernel maintainers, and organizations running custom kernel builds with SPI device support

Technical summary

The vulnerability exists in the Linux kernel's Serial Peripheral Interface (SPI) subsystem. When spi_setup() fails during device registration, the controller's cleanup() callback was not invoked, causing resources allocated by setup() to leak. The resolution adds proper cleanup invocation on setup failure paths. Multiple stable kernel branches received backported fixes.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version against patched stable releases (5.4, 5.10, 5.15, 6.1, 6.6, 6.12 per kernel.org stable commits)
  • Monitor NVD for CVSS score assignment as vulnerability remains in 'Awaiting Analysis' status
  • Assess SPI device registration failure handling in custom kernel modules
  • Apply stable kernel updates when available through distribution channels

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Fix confirmed via kernel.org stable tree commits. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis). Vendor identification marked low confidence by source system due to 'Unknown Vendor' classification with 'Kernel' as domain candidate.

Official resources

2026-05-27