CVE-2026-23475

Root

Cause

In the Linux kernel's SPI subsystem, per-CPU statistics for a controller are not allocated until after the controller is registered with the driver core. This leaves a window where accessing sysfs attributes related to those statistics can trigger a NULL-pointer dereference, as the memory for the statistics has not yet been allocated [1][2].

Exploitation

An attacker with local access to the system can trigger this vulnerability by reading SPI controller statistics from sysfs during the race window between controller registration and statistics allocation. No special privileges beyond local access are required, though the attacker must be able to interact with sysfs files for the affected device [3][4].

Impact

Successful exploitation results in a denial of service due to a kernel NULL-pointer dereference, causing a system crash or hang. The vulnerability does not allow privilege escalation or code execution, as it is a memory access bug rather than a memory corruption issue [1][4].

Mitigation

The fix moves the statistics allocation to controller allocation time and ties its lifetime to that of the controller using proper memory management, rather than implicit devres. Patches have been applied to the Linux kernel stable branches and are available in the referenced commits [1][2][3][4].