CVE-2024-26866: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26866 affects the Linux kernel's SPI subsystem, specifically the LPSPI (Low Power SPI) driver. The vulnerability was discovered in the fsl_lpspi_probe() function where memory allocation and disposal are handled incorrectly, leading to a potential use-after-free condition. This issue affects Linux kernel versions from 4.10 up to (excluding) 6.6.23, versions from 6.7 up to (excluding) 6.7.11, and versions from 6.8 up to (excluding) 6.8.2 (NVD).

The vulnerability stems from a mismatch in memory management approaches within the fsl_lpspi_probe() function. The function uses manual memory allocation with spi_alloc_host()/spi_alloc_target() while employing devm_spi_register_controller() for device registration. In error scenarios after the devm_spi_register_controller() call, the memory is explicitly freed by spi_controller_put(), but is subsequently accessed by the device management framework through devm_spi_unregister(), resulting in a use-after-free condition. This can lead to a NULL pointer dereference at virtual address 0x70 (Kernel Patch).

The vulnerability can result in a denial of service condition through a system crash when the affected code path is triggered. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium), indicating local access is required and the primary impact is to system availability (NVD).

The vulnerability requires local access to the system and can be triggered during device probe operations. No public exploits have been reported in the wild, though the technical details of the vulnerability have been publicly disclosed through the kernel patch system (Kernel Patch).

The issue has been fixed in Linux kernel versions 6.6.23, 6.7.11, and 6.8.2. The fix involves replacing the manual memory allocation calls with their device-managed counterparts (devm_spi_alloc_host/devm_spi_alloc_target). Users are advised to upgrade to these or later versions. Ubuntu has released fixes for affected versions in their 24.04 LTS release (Ubuntu Security).