CVE-2026-23431

Vulnerability

In the Linux kernel's Amlogic SPI driver (spi-amlogic-spisg), the probe function aml_spisg_probe() allocates a SPI controller structure using spi_alloc_target() or spi_alloc_host() but fails to release it via spi_controller_put() in several error paths. This results in a memory leak whenever the driver probe fails after allocation [1][2][3].

Exploitation

An attacker would need to trigger a probe failure of the amlogic-spisg driver, which could be achieved through system configuration or hotplug events. The vulnerability does not require authentication or special privileges beyond the ability to cause the driver to bind to a device and fail.

Impact

The memory leak can lead to gradual memory exhaustion, potentially causing system instability or denial of service if the driver repeatedly fails to probe. No other security impact, such as code execution or privilege escalation, has been identified.

Mitigation

The fix converts the allocation to use devm_spi_alloc_host() / devm_spi_alloc_target(), which automatically frees the controller on probe failure. Patches have been merged into the Linux kernel stable branches [1][2][3].