CVE-2026-31487

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31487", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.101Z", "datePublished": "2026-04-22T13:54:12.290Z", "dateUpdated": "2026-11-05T21:45:01.645Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:19.125Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \"\" to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\"\\n\" instead of \"(null)\\n\"."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi.c", "include/linux/spi/spi.h"], "versions": [{"version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "6e8eb467bed6aa1a563dba8f366c9fd76ba0004e", "status": "affected", "versionType": "git"}, {"version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0", "status": "affected", "versionType": "git"}, {"version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "c73a58661a760373d08a6883af4f0bb5cc991a67", "status": "affected", "versionType": "git"}, {"version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0", "status": "affected", "versionType": "git"}, {"version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "cc34d77dd48708d810c12bfd6f5bf03304f6c824", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi.c", "include/linux/spi/spi.h"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6e8eb467bed6aa1a563dba8f366c9fd76ba0004e"}, {"url": "https://git.kernel.org/stable/c/eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0"}, {"url": "https://git.kernel.org/stable/c/c73a58661a760373d08a6883af4f0bb5cc991a67"}, {"url": "https://git.kernel.org/stable/c/e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0"}, {"url": "https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}], "title": "spi: use generic driver_override infrastructure", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31487", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:34:57.394570Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:01.645Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31487", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:34:57.394570Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:34:59.439Z"}}], "cna": {"title": "spi: use generic driver_override infrastructure", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "6e8eb467bed6aa1a563dba8f366c9fd76ba0004e", "versionType": "git"}, {"status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0", "versionType": "git"}, {"status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "c73a58661a760373d08a6883af4f0bb5cc991a67", "versionType": "git"}, {"status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0", "versionType": "git"}, {"status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "lessThan": "cc34d77dd48708d810c12bfd6f5bf03304f6c824", "versionType": "git"}], "programFiles": ["drivers/spi/spi.c", "include/linux/spi/spi.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/spi/spi.c", "include/linux/spi/spi.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6e8eb467bed6aa1a563dba8f366c9fd76ba0004e"}, {"url": "https://git.kernel.org/stable/c/eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0"}, {"url": "https://git.kernel.org/stable/c/c73a58661a760373d08a6883af4f0bb5cc991a67"}, {"url": "https://git.kernel.org/stable/c/e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0"}, {"url": "https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \"\" to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\"\\n\" instead of \"(null)\\n\"."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:19.125Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31487", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:01.645Z", "dateReserved": "2026-03-09T15:48:24.101Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:12.290Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/spi/spi.c", "include/linux/spi/spi.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6e8eb467bed6aa1a563dba8f366c9fd76ba0004e", "status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "versionType": "git"}, {"lessThan": "eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0", "status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "versionType": "git"}, {"lessThan": "c73a58661a760373d08a6883af4f0bb5cc991a67", "status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "versionType": "git"}, {"lessThan": "e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0", "status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "versionType": "git"}, {"lessThan": "cc34d77dd48708d810c12bfd6f5bf03304f6c824", "status": "affected", "version": "5039563e7c25eccd7fec1de6706011009d1c5665", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/spi/spi.c", "include/linux/spi/spi.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3C61F04-9870-47B4-9862-7EFC3B5600C8", "versionEndExcluding": "6.12.80", "versionStartIncluding": "4.20.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*", "matchCriteriaId": "1072305B-94A8-4D68-9419-B786885AA310", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \"\" to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\"\\n\" instead of \"(null)\\n\"."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nspi: usar la infraestructura gen\u00e9rica de driver_override\n\nCuando un controlador es sondeado a trav\u00e9s de __driver_attach(), la funci\u00f3n de devoluci\u00f3n de llamada match() del bus es llamada sin el bloqueo del dispositivo activo, accediendo as\u00ed al campo driver_override sin un bloqueo, lo que puede causar un UAF.\n\nEsto se soluciona usando la infraestructura driver_override del driver-core, gestionando internamente el bloqueo adecuado.\n\nTenga en cuenta que llamar a match() desde __driver_attach() sin el bloqueo del dispositivo activo es intencional. [1]\n\nTambi\u00e9n tenga en cuenta que no habilitamos la caracter\u00edstica driver_override de la estructura bus_type, ya que SPI - a diferencia de la mayor\u00eda de otros buses - pasa \u2019\u2019 a sysfs_emit() cuando el puntero driver_override es NULL. As\u00ed, imprimiendo \u2019\\n\u2019 en lugar de \u2019(null)\\n\u2019."}], "id": "CVE-2026-31487", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31487", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:34:57.394570Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:46.307", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6e8eb467bed6aa1a563dba8f366c9fd76ba0004e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c73a58661a760373d08a6883af4f0bb5cc991a67"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: spi: use generic driver_override infrastructure", "id": "2460640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460640"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel, specifically within its Serial Peripheral Interface (SPI) subsystem. This vulnerability arises from improper handling of memory when a driver is being attached, leading to a use-after-free (UAF) condition. A UAF vulnerability is a type of memory corruption that can allow a local attacker to potentially escalate privileges or cause a system crash, impacting system stability and security."], "name": "CVE-2026-31487", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31487\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31487\nhttps://lore.kernel.org/linux-cve-announce/2026042200-CVE-2026-31487-a0ca@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5039563e7c25eccd7fec1de6706011009d1c5665,eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5039563e7c25eccd7fec1de6706011009d1c5665,c73a58661a760373d08a6883af4f0bb5cc991a67)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5039563e7c25eccd7fec1de6706011009d1c5665,e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5039563e7c25eccd7fec1de6706011009d1c5665,cc34d77dd48708d810c12bfd6f5bf03304f6c824)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.80,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.21,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T00:06:09.312160+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to the latest version that incorporates the driver_override fix demonstrated by the commits in the provided references.", "Rebuild or reapply any custom kernel modules to ensure they reference the patched SPI driver implementation.", "Monitor system logs for anomalous driver attach failures or memory errors that may indicate an attempt to exploit the race condition."], "summary": {"action": "Apply patch", "impact": "Use-After-Free leading to memory corruption"}, "threat_synthesis": {"affected_systems": "Linux kernel for all releases affected by the unpatched driver_override handling in the SPI subsystem. The issue is present until the kernel includes the commit that uses the generic driver_override infrastructure to enforce locking.", "description_and_impact": "During driver attachment in the Linux kernel, the SPI bus calls the match() callback without holding the device lock, allowing read of the driver_override field without proper synchronization. This race can result in a Use-After-Free condition that may corrupt memory or allow arbitrary execution of code with kernel privileges. The vulnerability arises from insufficient locking around the driver_override infrastructure; an attacker could potentially trigger it by manipulating the probing order or device removal during matchmaking, though the exact vector is not explicitly detailed in the advisory.", "risk_and_exploitability": "The exploitability of the vulnerability relies on inducing the race condition during driver probing. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, indicating a low likelihood of exploitation in the wild. The CVSS score of 5.5 reflects a moderate severity, primarily due to its potential to cause data corruption or privilege escalation in kernel space. The lack of an explicit fix package in the advisory suggests that updating the kernel to the patched state is the definitive mitigation action."}}}}, "created": "2026-04-22T17:15:21.905693+00:00", "updated": "2026-04-29T00:15:43.463575+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}