CVE-2026-46296

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46296", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.110Z", "datePublished": "2026-06-08T15:46:23.539Z", "dateUpdated": "2026-06-19T12:00:10.948Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-19T12:00:10.948Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: s3c64xx: fix NULL-deref on driver unbind\n\nA change moving DMA channel allocation from probe() back to\ns3c64xx_spi_prepare_transfer() failed to remove the corresponding\ndeallocation from remove().\n\nDrop the bogus DMA channel release from remove() to avoid triggering a\nNULL-pointer dereference on driver unbind.\n\nThis issue was flagged by Sashiko when reviewing a controller\nderegistration fix."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-s3c64xx.c"], "versions": [{"version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "lessThan": "29e219a18e21258bdb4ee12cecd0e9ec87d7e6a7", "status": "affected", "versionType": "git"}, {"version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "lessThan": "1108b8722b9ff0cdd3e8aa18d98244fcd93b6760", "status": "affected", "versionType": "git"}, {"version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "lessThan": "323a258f4b1916b5a3098618e036e033b2f2317f", "status": "affected", "versionType": "git"}, {"version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "lessThan": "1b66f16a571a10ba8889ac471755c8af9c5b9266", "status": "affected", "versionType": "git"}, {"version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "lessThan": "22788b1a8611380b141e09a8896702e32d164238", "status": "affected", "versionType": "git"}, {"version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "lessThan": "45daacbead8a009844bd5dba6cfa731332184d17", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-s3c64xx.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/29e219a18e21258bdb4ee12cecd0e9ec87d7e6a7"}, {"url": "https://git.kernel.org/stable/c/1108b8722b9ff0cdd3e8aa18d98244fcd93b6760"}, {"url": "https://git.kernel.org/stable/c/323a258f4b1916b5a3098618e036e033b2f2317f"}, {"url": "https://git.kernel.org/stable/c/1b66f16a571a10ba8889ac471755c8af9c5b9266"}, {"url": "https://git.kernel.org/stable/c/22788b1a8611380b141e09a8896702e32d164238"}, {"url": "https://git.kernel.org/stable/c/45daacbead8a009844bd5dba6cfa731332184d17"}], "title": "spi: s3c64xx: fix NULL-deref on driver unbind", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/spi/spi-s3c64xx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "29e219a18e21258bdb4ee12cecd0e9ec87d7e6a7", "status": "affected", "version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "versionType": "git"}, {"lessThan": "1108b8722b9ff0cdd3e8aa18d98244fcd93b6760", "status": "affected", "version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "versionType": "git"}, {"lessThan": "323a258f4b1916b5a3098618e036e033b2f2317f", "status": "affected", "version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "versionType": "git"}, {"lessThan": "1b66f16a571a10ba8889ac471755c8af9c5b9266", "status": "affected", "version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "versionType": "git"}, {"lessThan": "22788b1a8611380b141e09a8896702e32d164238", "status": "affected", "version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "versionType": "git"}, {"lessThan": "45daacbead8a009844bd5dba6cfa731332184d17", "status": "affected", "version": "f52b03c707444c5a3d1a0b9c5724f93ddc3c588e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/spi/spi-s3c64xx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.88", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D193E9E-2E9B-468E-B920-AD1EA1BA82C7", "versionEndExcluding": "6.1.176", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4", "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: s3c64xx: fix NULL-deref on driver unbind\n\nA change moving DMA channel allocation from probe() back to\ns3c64xx_spi_prepare_transfer() failed to remove the corresponding\ndeallocation from remove().\n\nDrop the bogus DMA channel release from remove() to avoid triggering a\nNULL-pointer dereference on driver unbind.\n\nThis issue was flagged by Sashiko when reviewing a controller\nderegistration fix."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nspi: s3c64xx: corrige desreferencia NULL al desvincular el controlador\n\nUn cambio que movi\u00f3 la asignaci\u00f3n del canal DMA de probe() de vuelta a s3c64xx_spi_prepare_transfer() no elimin\u00f3 la desasignaci\u00f3n correspondiente de remove().\n\nEliminar la liberaci\u00f3n err\u00f3nea del canal DMA de remove() para evitar activar una desreferencia de puntero NULL al desvincular el controlador.\n\nEste problema fue se\u00f1alado por Sashiko al revisar una correcci\u00f3n de desregistro del controlador."}], "id": "CVE-2026-46296", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-06-08T17:16:48.037", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1108b8722b9ff0cdd3e8aa18d98244fcd93b6760"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1b66f16a571a10ba8889ac471755c8af9c5b9266"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/22788b1a8611380b141e09a8896702e32d164238"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29e219a18e21258bdb4ee12cecd0e9ec87d7e6a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/323a258f4b1916b5a3098618e036e033b2f2317f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/45daacbead8a009844bd5dba6cfa731332184d17"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: spi: s3c64xx: fix NULL-deref on driver unbind", "id": "2486443", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486443"}, "csaw": false, "cwe": "CWE-763", "details": ["A flaw was found in the Linux kernel's s3c64xx Serial Peripheral Interface (SPI) driver. An issue with incorrect DMA (Direct Memory Access) channel deallocation during driver unbind could lead to a NULL-pointer dereference. This vulnerability can cause a system crash, resulting in a denial of service."], "name": "CVE-2026-46296", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46296\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46296\nhttps://lore.kernel.org/linux-cve-announce/2026060858-CVE-2026-46296-1408@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f52b03c707444c5a3d1a0b9c5724f93ddc3c588e,1108b8722b9ff0cdd3e8aa18d98244fcd93b6760)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f52b03c707444c5a3d1a0b9c5724f93ddc3c588e,323a258f4b1916b5a3098618e036e033b2f2317f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f52b03c707444c5a3d1a0b9c5724f93ddc3c588e,1b66f16a571a10ba8889ac471755c8af9c5b9266)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f52b03c707444c5a3d1a0b9c5724f93ddc3c588e,22788b1a8611380b141e09a8896702e32d164238)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f52b03c707444c5a3d1a0b9c5724f93ddc3c588e,45daacbead8a009844bd5dba6cfa731332184d17)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-08T18:45:26.861867+00:00", "updated": "2026-08-13T20:45:02.481833+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}