PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46241 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's MPC52xx SPI controller driver. When SPI controller registration fails, the driver previously failed to properly disable and free allocated interrupts, leading to potential use-after-free conditions and resource leaks. The vulnerability was identified during review of a related controller deregistration fix. The fix ensures proper cleanup of interrupt resources on registration failure paths.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running embedded Linux systems on Freescale/NXP MPC52xx hardware; industrial control system operators using PowerPC-based SPI peripherals; kernel maintainers for embedded distributions with MPC52xx support

Technical summary

The MPC52xx SPI controller driver in the Linux kernel contains a use-after-free vulnerability triggered when controller registration fails. The flaw occurs because interrupt resources are not properly disabled and freed during error handling, leaving dangling pointers and leaked resources. The vulnerability affects embedded systems utilizing Freescale/NXP MPC52xx PowerPC processors with SPI interfaces. Multiple stable kernel branches received fixes via commits addressing the interrupt cleanup sequence in the probe failure path.

Defensive priority

medium

Recommended defensive actions

  • Review kernel patch commits for MPC52xx SPI driver to verify interrupt cleanup logic in error paths
  • Audit systems using Freescale/NXP MPC52xx-based hardware for kernel versions prior to fix integration
  • Validate SPI controller probe failure handling in custom kernel builds for embedded MPC52xx deployments
  • Monitor stable kernel updates for backported fixes to affected long-term support branches

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-28. Fix commits identified in kernel.org stable tree. Vendor attribution marked low confidence requiring review due to 'Unknown Vendor' classification in source data.

Official resources

2026-05-28