CVE-2026-23068: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23068 Overview

CVE-2026-23068 is a double free vulnerability [CWE-415] in the Linux kernel's spi-sprd-adi SPI controller driver. The flaw exists in the driver's probe error handling path, where the spi_controller structure can be released twice when initialization fails. The driver allocates the controller using spi_alloc_host() but registers it through the managed devm_spi_register_controller() interface, creating inconsistent ownership semantics that trigger a double free if devm_register_restart_handler() fails.

The issue affects Linux kernel versions through 6.19-rc6 and has been resolved upstream.

Critical Impact
Local attackers with the ability to trigger driver probe failures can corrupt kernel memory, potentially leading to privilege escalation or denial of service on systems using Spreadtrum (Unisoc) ADI SPI controllers.

Affected Products

Linux Kernel versions prior to the fix commits
Linux Kernel 6.19-rc1 through 6.19-rc6
Systems using the spi-sprd-adi driver (Spreadtrum/Unisoc SoC platforms)

Discovery Timeline

2026-02-04 - CVE-2026-23068 published to NVD
2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-23068

Vulnerability Analysis

The spi-sprd-adi driver manages the Analog-to-Digital Interface SPI controller used on Spreadtrum/Unisoc platforms. The vulnerability arises from mixing manual and device-managed resource allocation patterns. The driver calls spi_alloc_host() to allocate the SPI controller structure, but later registers the controller with devm_spi_register_controller(), which transfers ownership to the device-managed (devm) framework.

When the probe routine subsequently calls devm_register_restart_handler() and that call fails, execution jumps to the put_ctlr cleanup label. This label invokes spi_controller_put() to release the controller. However, because the controller was already registered via devm_spi_register_controller(), the device core automatically calls spi_controller_put() a second time when probe returns an error, freeing the same memory twice.

Root Cause

The root cause is inconsistent use of device-managed and manual resource lifecycle APIs within the same probe function. The fix replaces spi_alloc_host() with devm_spi_alloc_host() and removes the explicit spi_controller_put() call, unifying resource ownership under the devm framework.

Attack Vector

Exploitation requires local access with privileges sufficient to load, unload, or rebind the affected kernel driver, or to trigger conditions that cause the restart handler registration to fail. Successful exploitation of a double free in kernel context can result in heap corruption, use-after-free conditions, and potentially arbitrary kernel code execution leading to local privilege escalation.

No public proof-of-concept exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-23068

Indicators of Compromise

Kernel panic or oops messages referencing spi_controller_put or SLUB double-free detection during boot or driver rebind operations
KASAN reports identifying double-free on spi_controller allocations originating from sprd_adi_probe
Unexpected reboots or device probe failures on Spreadtrum/Unisoc-based hardware

Detection Strategies

Enable kernel hardening features such as CONFIG_SLAB_FREELIST_HARDENED and KASAN in test environments to surface double-free conditions before they reach production
Audit installed kernel versions against the patched commits referenced in the Linux Kernel stable tree
Monitor dmesg output for driver probe failures on the spi-sprd-adi module

Monitoring Recommendations

Collect kernel ring buffer logs centrally and alert on SLUB or KASAN signatures associated with SPI subsystem allocations
Track driver load and unload events through auditd rules on init_module and delete_module syscalls
Inventory affected hardware running Spreadtrum/Unisoc SoCs to prioritize patching

How to Mitigate CVE-2026-23068

Immediate Actions Required

Identify systems running the spi-sprd-adi driver, typically Spreadtrum/Unisoc-based embedded devices, mobile platforms, and IoT hardware
Apply the upstream Linux kernel patches referenced by commit hashes 346775f2b4cf, 383d4f5cffcc, 417cdfd9b9f9, bddd3d10d039, and f6d6b3f172df
Restrict local access and module loading privileges to trusted administrators only

Patch Information

The vulnerability is resolved in upstream Linux kernel commits available in the stable tree. The fix replaces spi_alloc_host() with devm_spi_alloc_host() and removes the redundant spi_controller_put() call in the probe error path. Reference patches are published in the Linux Kernel Git repository and backported to maintained stable branches.

Workarounds

Unload or blacklist the spi-sprd-adi driver on systems where the SPI controller is not required for operation
Restrict CAP_SYS_MODULE and unprivileged user namespace creation to limit local attack surface
Apply vendor BSP updates from device manufacturers that ship downstream Linux kernels containing the fix

bash

# Blacklist the affected module until patches are applied
echo "blacklist spi_sprd_adi" | sudo tee /etc/modprobe.d/blacklist-spi-sprd-adi.conf
sudo update-initramfs -u