
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2024-26866 affects the Linux kernel's SPI subsystem, specifically the LPSPI (Low Power SPI) driver. The vulnerability was discovered in the fsl_lpspi_probe() function where memory allocation and disposal are handled incorrectly, leading to a potential use-after-free condition. This issue affects Linux kernel versions from 4.10 up to (excluding) 6.6.23, versions from 6.7 up to (excluding) 6.7.11, and versions from 6.8 up to (excluding) 6.8.2 (NVD).
The vulnerability stems from a mismatch in memory management approaches within the fsl_lpspi_probe() function. The function uses manual memory allocation with spi_alloc_host()/spi_alloc_target() while employing devm_spi_register_controller() for device registration. In error scenarios after the devm_spi_register_controller() call, the memory is explicitly freed by spi_controller_put(), but is subsequently accessed by the device management framework through devm_spi_unregister(), resulting in a use-after-free condition. This can lead to a NULL pointer dereference at virtual address 0x70 (Kernel Patch).
The vulnerability can result in a denial of service condition through a system crash when the affected code path is triggered. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium), indicating local access is required and the primary impact is to system availability (NVD).
The vulnerability requires local access to the system and can be triggered during device probe operations. No public exploits have been reported in the wild, though the technical details of the vulnerability have been publicly disclosed through the kernel patch system (Kernel Patch).
The issue has been fixed in Linux kernel versions 6.6.23, 6.7.11, and 6.8.2. The fix involves replacing the manual memory allocation calls with their device-managed counterparts (devm_spi_alloc_host/devm_spi_alloc_target). Users are advised to upgrade to these or later versions. Ubuntu has released fixes for affected versions in their 24.04 LTS release (Ubuntu Security).
Fix availability across major Linux distributions and their releases.
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."