In the Linux kernel, the following vulnerability has been resolved:

spi: imx: fix use-after-free on unbind

The SPI subsystem frees the controller and any subsystem allocated
driver data as part of deregistration (unless the allocation is device
managed).

Take another reference before deregistering the controller so that the
driver data is not freed until the driver is done with it.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
307c897db762d1e0feee9477276b08f6deca4a5b affected < f99165ef067723221472ce1aff632bc74f562643
307c897db762d1e0feee9477276b08f6deca4a5b affected < 385a330083f8dd47c15b02e9a83aef9234a37003
307c897db762d1e0feee9477276b08f6deca4a5b affected < 132e47030b0b5e398e0da6c59df5a5dae9b52cff
307c897db762d1e0feee9477276b08f6deca4a5b affected < aa9025a498036b6012769f7af36d421385386c17
307c897db762d1e0feee9477276b08f6deca4a5b affected < 1c78c2002380a1fe31bfb01a3d5f29809e55a096
Linux Linux affected
Version Status Constraints
5.19 affected —
0 unaffected < 5.19
6.6.140 unaffected ≤ 6.6.*
6.12.86 unaffected ≤ 6.12.*
6.18.27 unaffected ≤ 6.18.*
7.0.4 unaffected ≤ 7.0.*
7.1-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/132e47030b0b5e398e0da6c59df5a5dae9b52cff cve-icon cve-icon
https://git.kernel.org/stable/c/1c78c2002380a1fe31bfb01a3d5f29809e55a096 cve-icon cve-icon
https://git.kernel.org/stable/c/385a330083f8dd47c15b02e9a83aef9234a37003 cve-icon cve-icon
https://git.kernel.org/stable/c/aa9025a498036b6012769f7af36d421385386c17 cve-icon cve-icon
https://git.kernel.org/stable/c/f99165ef067723221472ce1aff632bc74f562643 cve-icon cve-icon
History

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix use-after-free on unbind The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed). Take another reference before deregistering the controller so that the driver data is not freed until the driver is done with it.
Title spi: imx: fix use-after-free on unbind
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-27T12:55:50.195Z

Reserved: 2026-05-13T15:03:33.091Z

Link: CVE-2026-45996

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:17.180

Modified: 2026-05-27T14:48:03.013

Link: CVE-2026-45996

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T17:15:38Z

Weaknesses

No weakness.