CVE-2026-31485 spi: spi-fsl-lpspi: fix teardown order issue (UAF)
A use-after-free vulnerability in the Linux kernel's fsl_lpspi SPI driver allows attackers to cause a system crash via NULL pointer dereference during DMA teardown.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31485?
CVE-2026-31485 is a high-severity use after free vulnerability in Linux kernel, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
There is a teardown order issue in the driver. The SPI controller is registered using devm_spi_register_controller(), which delays unregistration of the SPI controller until after the fsl_lpspi_remove() function returns.
As the fsl_lpspi_remove() function synchronously tears down the DMA channels, a running SPI transfer triggers the following NULL pointer dereference due to use after free:
| fsl_lpspi 42550000.spi: I/O Error in DMA RX | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] | Call trace: | fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi] | fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi] | spi_transfer_one_message+0x49c/0x7c8 | __spi_pump_transfer_message+0x120/0x420 | __spi_sync+0x2c4/0x520 | spi_sync+0x34/0x60 | spidev_message+0x20c/0x378 [spidev] | spidev_ioctl+0x398/0x750 [spidev] [...]
Switch from devm_spi_register_controller() to spi_register_controller() in fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in fsl_lpspi_remove().
Weakness: CWE-416
Which versions are affected by CVE-2026-31485?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31485?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31485 being exploited?
There is no known exploitation of CVE-2026-31485 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83300, BELL-CVE-2026-31485, DEBIAN-CVE-2026-31485, GHSA-355q-5chg-4qpr, ROOT-OS-DEBIAN-11-CVE-2026-31485, ROOT-OS-DEBIAN-12-CVE-2026-31485 and 4 more.