CVE-2026-23431: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23431 is a memory leak vulnerability in the Linux kernel's spi: amlogic-spisg driver, specifically within the aml_spisg_probe() function. The flaw arises because the ctlr structure allocated via spi_alloc_target() or spi_alloc_host() is not properly released via spi_controller_put() in several error paths during driver probe failure. Affected Linux kernel versions include 6.17 through before 6.18.20, 6.19.x before 6.19.10, and 7.0 release candidates (rc1–rc7). It was published on April 3, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): when aml_spisg_probe() encounters an error after allocating the SPI controller structure, it exits without calling spi_controller_put(), leaving the allocated memory unreleased. The fix converts the allocation to use the device-managed variants devm_spi_alloc_host() and devm_spi_alloc_target(), which automatically handle cleanup when the device is removed or probe fails. Exploitation requires local access with low privileges and is limited to systems using the Amlogic SPISG SPI driver. No public proof-of-concept or technical write-up beyond the kernel patch commits is known (GitHub Advisory).

The vulnerability results in memory leaks that accumulate each time the amlogic-spisg driver fails to probe after the initial allocation. Over repeated failed probe attempts, this can degrade system stability and reduce available memory resources, leading to a high availability impact. There is no confidentiality or integrity impact, and the scope is limited to the affected system without potential for lateral movement (GitHub Advisory).

There is no evidence of active in-the-wild exploitation, no public proof-of-concept exploit, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (5th percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges on a system running the affected Amlogic SPISG SPI driver (GitHub Advisory).

Update the Linux kernel to a patched version containing the fix for the amlogic-spisg driver: version 6.18.20 or 6.19.10 (or later stable releases). The fix is included in kernel commits bec21d97c968a4806939eb2946df49ea6c341bde, 8e28a01b69f7ea8df7ceb15470cfe643b2828f4f, and b8db9552997924b750e727a625a30eaa4603bbb9. Systems not using the Amlogic SPISG SPI driver are not affected. No configuration-based workaround is available; upgrading the kernel is the only remediation (GitHub Advisory).