CVE-2026-90433

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spi: oc-tiny: switch to managed controller allocation

The controller is allocated with the non-managed spi_alloc_host() while

the interrupt is registered with devm_request_irq(). During removal,

spi_bitbang_stop() only unregisters the controller; the subsequent

spi_controller_put() then frees the controller together with its

embedded driver-private devdata, which is the IRQ handler's dev_id. The

devm_request_irq() release action (free_irq()), which drains the

handler, does not run until after .remove() returns. A late or latched

interrupt can therefore reach tiny_spi_irq() and dereference

already-freed memory (e.g. hw->base).

Switch to devm_spi_alloc_host() so that the devres LIFO order releases

the controller only after free_irq() has drained the handler, and drop

the now-redundant spi_controller_put() from .remove(). The probe error

path is simplified to direct returns.

This issue was found by an in-house sta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References