---
id: CVE-2025-37842
title: 'spi: fsl-qspi: use devm function instead of driver remove'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  spi: fsl-qspi: use devm function instead of driver remove

  Driver use devm APIs to manage clk/irq/resources and register the spi
  controller, but the legacy remove funct…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 <
    69d2d7020b9966817ffc7442ae778c29cb81813f
  - >-
    Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 <
    50ae352c1848cab408fb4f7d7f50c71f818bbdbf
  - >-
    Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 <
    f68b27d82a749117d9c7d7f33fa53f46373e38e2
  - >-
    Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 <
    439688dbe82baa10d4430dc3252bb5ef1183a171
  - >-
    Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 <
    f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8
  - >-
    Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 <
    40369bfe717e96e26650eeecfa5a6363563df6e4
  - Linux 5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:42:05.791177Z'
published: '2025-05-09'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:52:04.849Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-37842'
references:
  - url: 'https://git.kernel.org/stable/c/69d2d7020b9966817ffc7442ae778c29cb81813f'
  - url: 'https://git.kernel.org/stable/c/50ae352c1848cab408fb4f7d7f50c71f818bbdbf'
  - url: 'https://git.kernel.org/stable/c/f68b27d82a749117d9c7d7f33fa53f46373e38e2'
  - url: 'https://git.kernel.org/stable/c/439688dbe82baa10d4430dc3252bb5ef1183a171'
  - url: 'https://git.kernel.org/stable/c/f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8'
  - url: 'https://git.kernel.org/stable/c/40369bfe717e96e26650eeecfa5a6363563df6e4'
tags:
  - cve.org
epss: 0.00282
epssPercentile: 0.20876
ingestedAt: '2026-11-03T16:49:26.498Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

spi: fsl-qspi: use devm function instead of driver remove

Driver use devm APIs to manage clk/irq/resources and register the spi
controller, but the legacy remove function will be called first during
device detach and trigger kernel panic. Drop the remove function and use
devm_add_action_or_reset() for driver cleanup to ensure the release
sequence.

Trigger kernel panic on i.MX8MQ by
echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind

## Affected

- `Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 < 69d2d7020b9966817ffc7442ae778c29cb81813f`
- `Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 < 50ae352c1848cab408fb4f7d7f50c71f818bbdbf`
- `Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 < f68b27d82a749117d9c7d7f33fa53f46373e38e2`
- `Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 < 439688dbe82baa10d4430dc3252bb5ef1183a171`
- `Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 < f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8`
- `Linux >= 8fcb830a00f0980ffe38d223cdd9a4d2d24da476 < 40369bfe717e96e26650eeecfa5a6363563df6e4`
- `Linux 5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.