{"id":"CVE-2026-31485","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver. The SPI controller is\nregistered using devm_spi_register_controller()…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.10.1, < 5.10.253","linux_kernel >= 5.11, < 5.15.203","linux_kernel >= 5.16, < 6.1.168","linux_kernel >= 6.2, < 6.6.131","linux_kernel >= 6.7, < 6.12.80","linux_kernel >= 6.13, < 6.18.21","linux_kernel >= 6.19, < 6.19.11","linux_kernel = 4.10","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.11"],"published":"2026-04-22","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:07.593","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31485","references":[{"url":"https://git.kernel.org/stable/c/15650dfbaeeb14bcaaf053b93cf631db8d465300","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/adb25339b66112393fd6892ceff926765feb5b86","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b341c1176f2e001b3adf0b47154fc31589f7410e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca4483f36ac1b62e69f8b182c5b8f059e0abecfb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5d01f24bc6fbde40b4e567ef9160194b61267bc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3fd54f8b0317fbccc103961ddd660f2a32dcf0b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00131,"epssPercentile":0.02698,"ingestedAt":"2026-09-08T15:33:26.990Z","slug":"CVE-2026-31485","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver. The SPI controller is\nregistered using devm_spi_register_controller(), which delays\nunregistration of the SPI controller until after the fsl_lpspi_remove()\nfunction returns.\n\nAs the fsl_lpspi_remove() function synchronously tears down the DMA\nchannels, a running SPI transfer triggers the following NULL pointer\ndereference due to use after free:\n\n| fsl_lpspi 42550000.spi: I/O Error in DMA RX\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[...]\n| Call trace:\n|  fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]\n|  fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]\n|  spi_transfer_one_message+0x49c/0x7c8\n|  __spi_pump_transfer_message+0x120/0x420\n|  __spi_sync+0x2c4/0x520\n|  spi_sync+0x34/0x60\n|  spidev_message+0x20c/0x378 [spidev]\n|  spidev_ioctl+0x398/0x750 [spidev]\n[...]\n\nSwitch from devm_spi_register_controller() to spi_register_controller() in\nfsl_lpspi_probe() and add the corresponding spi_unregister_controller() in\nfsl_lpspi_remove().\n\n## Affected\n\n- `linux_kernel >= 4.10.1, < 5.10.253`\n- `linux_kernel >= 5.11, < 5.15.203`\n- `linux_kernel >= 5.16, < 6.1.168`\n- `linux_kernel >= 6.2, < 6.6.131`\n- `linux_kernel >= 6.7, < 6.12.80`\n- `linux_kernel >= 6.13, < 6.18.21`\n- `linux_kernel >= 6.19, < 6.19.11`\n- `linux_kernel = 4.10`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.11`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":221715,"id":"CVE-2026-31485","ts":1792035334509,"field":"cvss","old":null,"new":"7.8"},{"seq":221714,"id":"CVE-2026-31485","ts":1792035334509,"field":"severity","old":"none","new":"high"}]}