CVE-2026-74415

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74415", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.893Z", "datePublished": "2026-08-15T05:59:21.378Z", "dateUpdated": "2026-08-17T05:18:57.554Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:18:57.554Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: atcspi200: fix use-after-free when driver unbind\n\nDMA resource is initialized after SPI controller registration. So\nwhen driver unbind, this can trigger a use-after-free when DMA is\ntorn down while the controller is still alive and triggers DMA transfers."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-atcspi200.c"], "versions": [{"version": "34e3815ea4597131d4324a4aa243d2201e672005", "lessThan": "af6a34c41683067a314d2b58b39edecb2e5e4ac6", "status": "affected", "versionType": "git"}, {"version": "34e3815ea4597131d4324a4aa243d2201e672005", "lessThan": "565bdf45125a05aa8f622f58f598283f46ba43f4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-atcspi200.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/af6a34c41683067a314d2b58b39edecb2e5e4ac6"}, {"url": "https://git.kernel.org/stable/c/565bdf45125a05aa8f622f58f598283f46ba43f4"}], "title": "spi: atcspi200: fix use-after-free when driver unbind", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/spi/spi-atcspi200.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "af6a34c41683067a314d2b58b39edecb2e5e4ac6", "status": "affected", "version": "34e3815ea4597131d4324a4aa243d2201e672005", "versionType": "git"}, {"lessThan": "565bdf45125a05aa8f622f58f598283f46ba43f4", "status": "affected", "version": "34e3815ea4597131d4324a4aa243d2201e672005", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/spi/spi-atcspi200.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: atcspi200: fix use-after-free when driver unbind\n\nDMA resource is initialized after SPI controller registration. So\nwhen driver unbind, this can trigger a use-after-free when DMA is\ntorn down while the controller is still alive and triggers DMA transfers."}], "id": "CVE-2026-74415", "lastModified": "2026-08-17T06:19:36.980", "metrics": {}, "published": "2026-08-15T06:22:43.600", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/565bdf45125a05aa8f622f58f598283f46ba43f4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af6a34c41683067a314d2b58b39edecb2e5e4ac6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: spi: atcspi200: fix use-after-free when driver unbind", "id": "2516799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516799"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nspi: atcspi200: fix use-after-free when driver unbind\nDMA resource is initialized after SPI controller registration. So\nwhen driver unbind, this can trigger a use-after-free when DMA is\ntorn down while the controller is still alive and triggers DMA transfers.", "A flaw was found in the Linux kernel's atcspi200 Serial Peripheral Interface (SPI) driver. When the driver unbinds, the Direct Memory Access (DMA) resource can be prematurely deallocated while the SPI controller is still active and initiating DMA transfers. This timing issue can lead to a use-after-free vulnerability, which may allow a local attacker to cause a denial of service or potentially execute arbitrary code."], "name": "CVE-2026-74415", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74415\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74415\nhttps://lore.kernel.org/linux-cve-announce/2026081511-CVE-2026-74415-d5ca@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34e3815ea4597131d4324a4aa243d2201e672005,af6a34c41683067a314d2b58b39edecb2e5e4ac6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34e3815ea4597131d4324a4aa243d2201e672005,565bdf45125a05aa8f622f58f598283f46ba43f4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T16:15:03.533546+00:00", "updated": "2026-08-21T22:45:04.693321+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}