CVE-2021-46959

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spi: Fix use-after-free with devm_spi_alloc_*

We can't rely on the contents of the devres list during

spi_unregister_controller(), as the list is already torn down at the

time we perform devres_find() for devm_spi_release_controller. This

causes devices registered with devm_spi_alloc_{master,slave}() to be

mistakenly identified as legacy, non-devm managed devices and have their

reference counters decremented below 0.

------------[ cut here ]------------

WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174

[<b0396f04>] (refcount_warn_saturate) from [<b03c56a4>] (kobject_put+0x90/0x98)

[<b03c5614>] (kobject_put) from [<b0447b4c>] (put_device+0x20/0x24)

r4:b6700140

[<b0447b2c>] (put_device) from [<b07515e8>] (devm_spi_release_controller+0x3c/0x40)

[<b07515ac>] (devm_spi_release_controller) from [<b045343c>] (release_nodes+0x84/0xc4)

r5:b6700180 r4:b6700100

[<b04533b8>] (release_nodes) from

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References