{"id":"CVE-2024-26866","revision":"443b5e4e5e714b21a1e9759b3532dc5d","records":[{"revision":"443b5e4e5e714b21a1e9759b3532dc5d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-26866","aliases":[],"title":"spi: lpspi: Avoid potential use-after-free in probe()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: lpspi: Avoid potential use-after-free in probe()\n\nfsl_lpspi_probe() is allocating/disposing memory manually with\nspi_alloc_host()/spi_alloc_target(), but uses\ndevm_spi_register_controller(). In case of error after the latter call the\nmemory will be explicitly freed in the probe function by\nspi_controller_put() call, but used afterwards by \"devm\" management outside\nprobe() (spi_unregister_controller() <- devm_spi_unregister() below).\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000070\n...\nCall trace:\n kernfs_find_ns\n kernfs_find_and_get_ns\n sysfs_remove_group\n sysfs_remove_groups\n device_remove_attrs\n device_del\n spi_unregister_controller\n devm_spi_unregister\n release_nodes\n devres_release_all\n really_probe\n driver_probe_device\n __device_attach_driver\n bus_for_each_drv\n __device_attach\n device_initial_probe\n bus_probe_device\n deferred_probe_work_func\n process_one_work\n worker_thread\n kthread\n ret_from_fork","state":0,"publishedAt":"2024-04-17T10:27:28.163+00:00","modifiedAt":"2026-05-11T20:05:39.02+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/spi/spi-fsl-lpspi.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5314987de5e5f5e38436ef4a69328bc472bbd63e\",\n                            \"lessThan\": \"da83ed350e4604b976e94239b08d8e2e7eaee7ea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5314987de5e5f5e38436ef4a69328bc472bbd63e\",\n                            \"lessThan\": \"1543418e82789cc383cd36d41469983c64e3fc7f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5314987de5e5f5e38436ef4a69328bc472bbd63e\",\n                            \"lessThan\": \"996ce839606afd0fef91355627868022aa73eb68\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5314987de5e5f5e38436ef4a69328bc472bbd63e\",\n                            \"lessThan\": \"2ae0ab0143fcc06190713ed81a6486ed0ad3c861\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/spi/spi-fsl-lpspi.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.23\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.11\",\n                            \"lessThanOrEqual\": \"6.7.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8.2\",\n                            \"lessThanOrEqual\": \"6.8.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.9\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea","https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f","https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68","https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-26866","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-26866","identifiers":["CVE-2024-26866"]},"retained":false,"historicalAffected":[]}],"coverage":[]}