CVE-2026-31485

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-lpspi: fix teardown order issue (UAF) There is a teardown order issue in the driver. The SPI controller is registered using devm_spi_register_controller(), which delays unregistration of the SPI controller until after the fsl_lpspi_remove() function returns. As the fsl_lpspi_remove() function synchronously tears down the DMA channels, a running SPI transfer triggers the following NULL pointer dereference due to use after free: | fsl_lpspi 42550000.spi: I/O Error in DMA RX | Unable to handle kernel NULL pointer...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 5314987de5e5f5e38436ef4a69328bc472bbd63e < fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6, >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < ca4483f36ac1b62e69f8b182c5b8f059e0abecfb, >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < e3fd54f8b0317fbccc103961ddd660f2a32dcf0b, >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < adb25339b66112393fd6892ceff926765feb5b86, >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < d5d01f24bc6fbde40b4e567ef9160194b61267bc, >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3, >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < 15650dfbaeeb14bcaaf053b93cf631db8d465300, >= 5314987de5e5f5e38436ef4a69328bc472bbd63e < b341c1176f2e001b3adf0b47154fc31589f7410e, >= 4.10, >= V3.1.6, >= V3.1.5, >= 4.10.1 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.168, >= 6.2 < 6.6.131, >= 6.7 < 6.12.80, >= 6.13 < 6.18.21, >= 6.19 < 6.19.11, 4.10, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416