CVE-2026-90433 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems with the spi: oc-tiny module enabled should assess exposure and apply the patch or update to a fixed version.

Why it matters

A vulnerability in the Linux kernel's spi: oc-tiny module requires patching to prevent potential system instability or crashes. Linux kernel developers, maintainers, and users should assess exposure and apply the patch or update to a fixed version.

• Potential use-after-free condition leading to system instability or crash
• Need to verify Linux kernel version and apply patch or update
• Monitoring system logs for potential issues related to the spi: oc-tiny module

Technical summary

The Linux kernel's spi: oc-tiny module had a vulnerability due to improper resource management. The controller was allocated with spi_alloc_host() but the interrupt was registered with devm_request_irq(). This could lead to a use-after-free condition when a late or latched interrupt occurred. The fix involves switching to devm_spi_alloc_host() to ensure that the controller is released after the interrupt handler has finished.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to update the spi: oc-tiny module to use devm_spi_alloc_host()
• Verify the Linux kernel version and update to a version that includes the fix
• Monitor system logs for potential issues related to the spi: oc-tiny module
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue was identified by an in-house static analysis tool. The fix involves changing the controller allocation method to devm_spi_alloc_host(). To verify, defenders should review the Linux kernel version and apply the patch or update to a fixed version, ensuring that the spi: oc-tiny module is updated to use devm_spi_alloc_host(). This change prevents a use-after-free condition that could lead to system instability or crashes. The analysis tool's findings were based on the Linux kernel's source code and the specific configuration

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.