---
id: CVE-2024-26866
title: 'spi: lpspi: Avoid potential use-after-free in probe()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  spi: lpspi: Avoid potential use-after-free in probe()

  fsl_lpspi_probe() is allocating/disposing memory manually with
  spi_alloc_host()/spi_alloc_target(), but uses
  devm…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e <
    57a9b7fe61031f30c90d20c898160c397f6abe9f
  - >-
    Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e <
    da83ed350e4604b976e94239b08d8e2e7eaee7ea
  - >-
    Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e <
    1543418e82789cc383cd36d41469983c64e3fc7f
  - >-
    Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e <
    996ce839606afd0fef91355627868022aa73eb68
  - >-
    Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e <
    2ae0ab0143fcc06190713ed81a6486ed0ad3c861
  - Linux 4.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-05-28T19:57:41.631957Z'
published: '2024-04-17'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:17:54.784Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-26866'
references:
  - url: 'https://git.kernel.org/stable/c/57a9b7fe61031f30c90d20c898160c397f6abe9f'
  - url: 'https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea'
  - url: 'https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f'
  - url: 'https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68'
  - url: 'https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.12059
ingestedAt: '2026-11-03T12:44:28.797Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

spi: lpspi: Avoid potential use-after-free in probe()

fsl_lpspi_probe() is allocating/disposing memory manually with
spi_alloc_host()/spi_alloc_target(), but uses
devm_spi_register_controller(). In case of error after the latter call the
memory will be explicitly freed in the probe function by
spi_controller_put() call, but used afterwards by "devm" management outside
probe() (spi_unregister_controller() <- devm_spi_unregister() below).

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070
...
Call trace:
 kernfs_find_ns
 kernfs_find_and_get_ns
 sysfs_remove_group
 sysfs_remove_groups
 device_remove_attrs
 device_del
 spi_unregister_controller
 devm_spi_unregister
 release_nodes
 devres_release_all
 really_probe
 driver_probe_device
 __device_attach_driver
 bus_for_each_drv
 __device_attach
 device_initial_probe
 bus_probe_device
 deferred_probe_work_func
 process_one_work
 worker_thread
 kthread
 ret_from_fork

## Affected

- `Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < 57a9b7fe61031f30c90d20c898160c397f6abe9f`
- `Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < da83ed350e4604b976e94239b08d8e2e7eaee7ea`
- `Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < 1543418e82789cc383cd36d41469983c64e3fc7f`
- `Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < 996ce839606afd0fef91355627868022aa73eb68`
- `Linux >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < 2ae0ab0143fcc06190713ed81a6486ed0ad3c861`
- `Linux 4.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.