PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46228 Linux CVE debrief

A vulnerability in the Linux kernel's CH341 USB-to-SPI driver has been resolved. The issue involved incorrect device resource (devres) lifetime management, where controller and driver data were tied to the parent USB device rather than the USB interface. This could lead to memory leaks when drivers were unbound without physical disconnection, such as during probe deferral or configuration changes. The fix ensures proper resource cleanup on driver unbind and correct placement of the SPI controller in the device tree under the USB interface.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

System administrators managing Linux systems with CH341 USB-to-SPI adapters; embedded systems developers using CH341-based hardware; kernel maintainers tracking stable branch updates

Technical summary

The CH341 USB-to-SPI driver in the Linux kernel incorrectly managed device resource lifetimes by binding them to the parent USB device instead of the USB interface. This caused memory leaks during driver unbind scenarios like probe deferral or configuration changes. The fix corrects the controller and driver data lifetime to release on driver unbind and ensures proper device tree placement of the SPI controller under the USB interface.

Defensive priority

medium

Recommended defensive actions

  • Review systems using CH341 USB-to-SPI adapters and apply kernel updates containing the referenced commits
  • Monitor kernel stable releases for inclusion of this fix
  • Verify SPI controller device tree placement on affected systems after driver updates

Evidence notes

The CVE description and source references confirm this is a memory management fix in the Linux kernel's spi: ch341 driver. The fix addresses devres lifetime issues by binding resources to the USB interface rather than the parent USB device. Three kernel.org stable commits are provided as references.

Official resources

2026-05-28T10:16:38.433Z