PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46228 Linux CVE debrief

A vulnerability in the Linux kernel's CH341 USB-to-SPI driver has been resolved. The issue involved incorrect device resource (devres) lifetime management, where controller and driver data were tied to the parent USB device rather than the USB interface. This could lead to memory leaks when drivers were unbound without physical disconnection, such as during probe deferral or configuration changes. The fix ensures proper resource cleanup on driver unbind and correct placement of the SPI controller in the device tree under the USB interface.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

System administrators managing Linux systems with CH341 USB-to-SPI adapters; embedded systems developers using CH341-based hardware; kernel maintainers tracking stable branch updates

Technical summary

The CH341 USB-to-SPI driver in the Linux kernel incorrectly managed device resource lifetimes by binding them to the parent USB device instead of the USB interface. This caused memory leaks during driver unbind scenarios like probe deferral or configuration changes. The fix corrects the controller and driver data lifetime to release on driver unbind and ensures proper device tree placement of the SPI controller under the USB interface.

Defensive priority

medium

Recommended defensive actions

  • Review systems using CH341 USB-to-SPI adapters and apply kernel updates containing the referenced commits
  • Monitor kernel stable releases for inclusion of this fix
  • Verify SPI controller device tree placement on affected systems after driver updates

Evidence notes

The CVE description and source references confirm this is a memory management fix in the Linux kernel's spi: ch341 driver. The fix addresses devres lifetime issues by binding resources to the USB interface rather than the parent USB device. Three kernel.org stable commits are provided as references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46228 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46228

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46228 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46228

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/108a64b27a52f781c4f3751641e3dd65c7dd2fb5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4422fc2411cbbdf5104a914e0596bb483faea254

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/abe572f630bc1f0e77041012ab075869036ede4f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.