CVE-2026-23068: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23068 is a double-free vulnerability in the Linux kernel's spi-sprd-adi SPI driver, located in the probe error path. The flaw arises because the driver allocates an SPI controller with spi_alloc_host() but registers it using devm_spi_register_controller(), causing spi_controller_put() to be called twice when devm_register_restart_handler() fails — once manually and once automatically by the device resource management (devm) framework. Affected kernel versions span from 4.17 through multiple stable branches, with fixes available in 6.1.162, 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, kernel.org patches).

The root cause is classified as CWE-415 (Double Free): the spi-sprd-adi driver's probe function calls spi_alloc_host() for controller allocation and devm_spi_register_controller() for registration. When a subsequent call to devm_register_restart_handler() fails, the error-handling path jumps to the put_ctlr label and explicitly invokes spi_controller_put(). However, because the controller was registered via a devm-managed function, the kernel's device core automatically calls spi_controller_put() a second time during probe failure cleanup, resulting in a double-free of the spi_controller structure. The fix replaces spi_alloc_host() with devm_spi_alloc_host() and removes the manual spi_controller_put() call, delegating full lifecycle management to the devm framework (Feedly, kernel.org patches).

Successful exploitation of this double-free condition could lead to kernel memory corruption, potentially enabling a local attacker with low privileges to crash the system (denial of service) or achieve arbitrary code execution in kernel context. Given the high confidentiality, integrity, and availability impact ratings, a successful exploit could allow privilege escalation or full system compromise. The vulnerability is limited to systems using the Spreadtrum ADI SPI controller driver, which is primarily found in Unisoc/Spreadtrum SoC-based devices (Feedly).

Update the Linux kernel to one of the patched stable versions: 6.1.162 or later, 6.6.122 or later, 6.12.68 or later, 6.18.8 or later, or 6.19-rc7 and later. Upstream fixes are available at multiple git.kernel.org commit references (e.g., 346775f2b4cf, 383d4f5cffcc, 417cdfd9b9f9, bddd3d10d039, f6d6b3f172df). As a temporary workaround prior to patching, restrict local user access on systems running affected Spreadtrum ADI SPI hardware to reduce the attack surface (Feedly, kernel.org patches).