PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46219 Linux CVE debrief

A use-after-free vulnerability exists in the Freescale MPC52xx SPI driver within the Linux kernel. The issue occurs during driver unbind operations when the state machine work, scheduled by the interrupt handler, is not properly cancelled after interrupts are disabled. This timing window allows the work to execute after the driver data structures have been freed, leading to memory corruption. The vulnerability affects systems utilizing the MPC52xx SPI controller, commonly found in embedded PowerPC platforms. Multiple stable kernel branches have received patches to address this race condition by ensuring proper work cancellation ordering.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running embedded Linux systems with Freescale/NXP MPC52xx PowerPC processors utilizing SPI interfaces; industrial control system operators; automotive ECU manufacturers; telecommunications equipment vendors with legacy PowerPC-based hardware

Technical summary

The MPC52xx SPI driver in the Linux kernel contains a use-after-free vulnerability triggered during driver unbind. The driver's state machine work is scheduled via interrupt handler; if the work is not cancelled after interrupts are disabled but before driver data is freed, the scheduled work may execute against freed memory. The resolution ensures proper cancellation ordering: disable interrupts first, then cancel pending work, preventing the race window.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from distribution vendors once patches are available
  • Monitor stable kernel releases for MPC52xx SPI driver fixes
  • Review custom kernel builds for inclusion of the referenced commits
  • Validate SPI driver unload procedures in embedded deployments using MPC52xx hardware

Evidence notes

The vulnerability description indicates a classic race condition in kernel driver teardown. The fix involves cancelling scheduled work after interrupt disablement to prevent use-after-free. Five kernel.org stable branch commits are referenced, suggesting backports to multiple maintained kernel versions. No CVSS score has been assigned by NVD as of the modified date.

Official resources

2026-05-28