CVE-2024-26866

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

spi: lpspi: Avoid potential use-after-free in probe()

fsl_lpspi_probe() is allocating/disposing memory manually with

spi_alloc_host()/spi_alloc_target(), but uses

devm_spi_register_controller(). In case of error after the latter call the

memory will be explicitly freed in the probe function by

spi_controller_put() call, but used afterwards by "devm" management outside

probe() (spi_unregister_controller() <- devm_spi_unregister() below).

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070

...

Call trace:

kernfs_find_ns

kernfs_find_and_get_ns

sysfs_remove_group

sysfs_remove_groups

device_remove_attrs

device_del

spi_unregister_controller

devm_spi_unregister

release_nodes

devres_release_all

really_probe

driver_probe_device

__device_attach_driver

bus_for_each_drv

__device_attach

device_initial_probe

bus_probe_device

deferred_probe_work_func

process_one_work

worker_thre

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References