CVE-2026-43004

Vulnerability

In the Linux kernel's STM32 OctoSPI driver (spi-stm32-ospi), the remove() callback contains a resource leak. If pm_runtime_resume_and_get() fails, the function returns early without cleaning up the SPI controller and associated resources, leading to a classic missing cleanup path. [1]

Attack

Surface

Local access is required to trigger device removal (e.g., unbinding the driver via sysfs or module removal). No authentication beyond normal user privileges for driver operations is needed. The attack surface is limited to physical or privileged user access to manipulate device binding. [1]

Impact

An attacker or unprivileged user who forces a faulty PM resume during driver removal can cause memory and device resource leaks. Repeated exploitation could exhaust system resources, leading to denial of service (kernel memory exhaustion or device unavailability). The CVSS 5.5 reflects the medium severity due to local access requirement and potential for DoS. [1]

Mitigation

Patched in mainline via commit 0807532c5ebb (also backported as commits 73cd1f97946a and b4ec54c974c6). Users are advised to apply the latest stable kernel updates. No workaround exists beyond ensuring the driver is not removed while runtime PM resume is failing. [2][3]