---
id: CVE-2026-45996
title: 'spi: imx: fix use-after-free on unbind'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  spi: imx: fix use-after-free on unbind

  The SPI subsystem frees the controller and any subsystem allocated
  driver data as part of deregistration (unless the allocation …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b <
    c7c40c3e7b9fb900504aa746de3e53c5275b24bd
  - >-
    Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b <
    f99165ef067723221472ce1aff632bc74f562643
  - >-
    Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b <
    385a330083f8dd47c15b02e9a83aef9234a37003
  - >-
    Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b <
    132e47030b0b5e398e0da6c59df5a5dae9b52cff
  - >-
    Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b <
    aa9025a498036b6012769f7af36d421385386c17
  - >-
    Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b <
    1c78c2002380a1fe31bfb01a3d5f29809e55a096
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:04:23.088949Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:30.609Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45996'
references:
  - url: 'https://git.kernel.org/stable/c/c7c40c3e7b9fb900504aa746de3e53c5275b24bd'
  - url: 'https://git.kernel.org/stable/c/f99165ef067723221472ce1aff632bc74f562643'
  - url: 'https://git.kernel.org/stable/c/385a330083f8dd47c15b02e9a83aef9234a37003'
  - url: 'https://git.kernel.org/stable/c/132e47030b0b5e398e0da6c59df5a5dae9b52cff'
  - url: 'https://git.kernel.org/stable/c/aa9025a498036b6012769f7af36d421385386c17'
  - url: 'https://git.kernel.org/stable/c/1c78c2002380a1fe31bfb01a3d5f29809e55a096'
tags:
  - cve.org
epss: 0.00139
epssPercentile: 0.03311
ingestedAt: '2026-11-06T16:57:43.352Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

spi: imx: fix use-after-free on unbind

The SPI subsystem frees the controller and any subsystem allocated
driver data as part of deregistration (unless the allocation is device
managed).

Take another reference before deregistering the controller so that the
driver data is not freed until the driver is done with it.

## Affected

- `Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b < c7c40c3e7b9fb900504aa746de3e53c5275b24bd`
- `Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b < f99165ef067723221472ce1aff632bc74f562643`
- `Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b < 385a330083f8dd47c15b02e9a83aef9234a37003`
- `Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b < 132e47030b0b5e398e0da6c59df5a5dae9b52cff`
- `Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b < aa9025a498036b6012769f7af36d421385386c17`
- `Linux >= 307c897db762d1e0feee9477276b08f6deca4a5b < 1c78c2002380a1fe31bfb01a3d5f29809e55a096`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.