PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46241 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's MPC52xx SPI controller driver. When SPI controller registration fails, the driver previously failed to properly disable and free allocated interrupts, leading to potential use-after-free conditions and resource leaks. The vulnerability was identified during review of a related controller deregistration fix. The fix ensures proper cleanup of interrupt resources on registration failure paths.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running embedded Linux systems on Freescale/NXP MPC52xx hardware; industrial control system operators using PowerPC-based SPI peripherals; kernel maintainers for embedded distributions with MPC52xx support

Technical summary

The MPC52xx SPI controller driver in the Linux kernel contains a use-after-free vulnerability triggered when controller registration fails. The flaw occurs because interrupt resources are not properly disabled and freed during error handling, leaving dangling pointers and leaked resources. The vulnerability affects embedded systems utilizing Freescale/NXP MPC52xx PowerPC processors with SPI interfaces. Multiple stable kernel branches received fixes via commits addressing the interrupt cleanup sequence in the probe failure path.

Defensive priority

medium

Recommended defensive actions

  • Review kernel patch commits for MPC52xx SPI driver to verify interrupt cleanup logic in error paths
  • Audit systems using Freescale/NXP MPC52xx-based hardware for kernel versions prior to fix integration
  • Validate SPI controller probe failure handling in custom kernel builds for embedded MPC52xx deployments
  • Monitor stable kernel updates for backported fixes to affected long-term support branches

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-28. Fix commits identified in kernel.org stable tree. Vendor attribution marked low confidence requiring review due to 'Unknown Vendor' classification in source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46241 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46241

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46241 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46241

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/336d9ad7560b3baba17af06727a888040ee93390

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5c77f11b9b5f1ad5a704dad875260c44016ede10

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8b49b6aadd0c622ca7d68b4a53ae10362e221cf3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f62c060272b9d7423b1650b844e8e4e7b8f9f925

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.