PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46301 Linux CVE debrief

A use-after-free vulnerability was discovered in the Linux kernel's spi: topcliff-pch driver. The vulnerability occurs when the driver unbinds, allowing a chance to flush its queue before releasing the DMA buffers.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel with the spi: topcliff-pch driver enabled should be aware of this vulnerability.

Technical summary

The Linux kernel's spi: topcliff-pch driver has a use-after-free vulnerability. When the driver unbinds, it does not properly handle its queue, leading to a potential use-after-free condition.

Defensive priority

medium

Recommended defensive actions

  • Apply the patches provided by the Linux kernel maintainers to fix the vulnerability.
  • Ensure that the Linux kernel is updated with the latest security patches.

Evidence notes

The vulnerability was resolved by giving the driver a chance to flush its queue before releasing the DMA buffers on driver unbind.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46301 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46301

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46301 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46301

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0e8e57f9737ea257634db1d152fc430a0788a3e1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/36e58c436d2c2a797800427dc04d74ffd8b6ce1c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/43334836b907adc21eab3079d2e6b26754468786

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4ca90deeca1c7dd72c1c380ba8143565516def2d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8822980668c96b5aa251c1e2daec1873262b8f3f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9d72732fe70c11424bc90ed466c7ccfa58b42a9a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d50ef3553acbacce6f2843304d41d06dca358bb6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.