CVE-2026-23475: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23475 is a NULL pointer dereference vulnerability in the Linux kernel's SPI (Serial Peripheral Interface) subsystem. The flaw arises because the per-CPU statistics for an SPI controller are not allocated until after the controller is registered with the driver core, creating a race window during which sysfs attribute access can trigger a kernel crash. Affected kernel versions span from 6.0 through multiple stable branches, including 6.0–6.1.167 (exclusive), 6.2–6.6.130 (exclusive), 6.7–6.12.78 (exclusive), 6.13–6.18.20 (exclusive), and 6.19–6.19.10 (exclusive), as well as pre-release 7.0-rc1 through rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). During SPI controller initialization, the per-CPU statistics structure is allocated only after spi_register_controller() completes registration with the driver core. This creates a time-of-check/time-of-use window where a local user or process reading sysfs attributes under /sys/class/spi_master/ can dereference a NULL pointer before the statistics memory is initialized. The fix moves statistics allocation to the controller allocation phase and ties its lifetime to the controller object rather than relying on implicit devres cleanup (GitHub Advisory, Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a denial of service affecting all processes on the host. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems relying on SPI hardware (e.g., embedded devices, IoT systems, servers with SPI-attached peripherals) are most at risk, and a crash could disrupt critical services running on affected hosts (Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing a NULL pointer dereference in the SPI subsystem (e.g., spi_statistics or related functions).
• Logs: Stack traces in kernel logs involving spi_master or spi_controller sysfs attribute handlers.
• System Behavior: Unexpected system reboots or kernel panics on systems with SPI hardware attached, particularly during SPI controller initialization or driver loading.

Apply the patched kernel versions released for each stable branch: 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0-rc5. Patches are available via the Linux kernel stable tree. As a temporary workaround prior to patching, restrict local user access to SPI controller sysfs attributes under /sys/class/spi_master/ using filesystem permissions or access control mechanisms. Prioritize patching on systems with SPI hardware actively in use (GitHub Advisory, SUSE Advisory, Amazon Linux).

SUSE issued security update announcements (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1) addressing this vulnerability among others in their kernel packages. Amazon Linux also released an advisory (ALAS2023-2026-1594). The Yocto Project security mailing list discussed the issue across multiple messages. No notable independent researcher commentary or significant social media discussion has been identified (SUSE Advisory, Amazon Linux, Yocto Security).