CVE-2026-90410

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spi: davinci: switch to managed controller allocation

The controller is allocated with the non-managed spi_alloc_host() while

the interrupt is registered with devm_request_threaded_irq(). During

removal, spi_bitbang_stop() only unregisters the controller; the

subsequent spi_controller_put() then frees the controller together with

its embedded davinci_spi devdata, which is the IRQ handler's dev_id.

The devm_request_threaded_irq() release action (free_irq()), which

drains the handler, does not run until after .remove() returns. A late

or latched interrupt can therefore reach davinci_spi_irq() and

dereference already-freed memory.

Switch to devm_spi_alloc_host() so that the devres LIFO order releases

the controller only after free_irq() has drained the handler, and drop

the now-redundant spi_controller_put() from .remove(). The probe error

path is simplified to direct returns.

The clock is acquired with devm_clk_ge

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References