CVE-2026-45996: Linux Kernel SPI Use-After-Free Flaw

CVE-2026-45996 Overview

CVE-2026-45996 is a use-after-free vulnerability in the Linux kernel's spi-imx driver. The flaw occurs during driver unbind, when the SPI subsystem frees the controller and any subsystem-allocated driver data as part of deregistration. The spi-imx driver continues to access this data after deregistration, leading to memory corruption. The upstream fix takes an additional reference on the controller before deregistration, ensuring driver data remains valid until the driver finishes using it.

Critical Impact

A use-after-free condition in the i.MX SPI driver unbind path can corrupt kernel memory, potentially enabling local privilege escalation or denial of service on affected systems.

Affected Products

• Linux kernel spi-imx driver (Serial Peripheral Interface for NXP i.MX SoCs)
• Stable kernel branches receiving the referenced backport commits
• Embedded and industrial platforms using NXP i.MX hardware with the in-tree SPI driver

Discovery Timeline

• 2026-05-27 - CVE-2026-45996 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45996

Vulnerability Analysis

The spi-imx driver, which provides SPI bus support for NXP i.MX system-on-chip platforms, mismanages object lifetimes during driver unbind. The Linux SPI subsystem owns the controller structure and any driver data allocated through subsystem helpers. When spi_unregister_controller() runs during unbind, the subsystem releases these allocations unless the driver opted into device-managed allocation.

The spi-imx driver continues to dereference fields belonging to the controller and its private data after deregistration completes. Any read or write through those dangling pointers constitutes a use-after-free [CWE-416]. The window appears during module removal or device unbind through sysfs.

The fix acquires an additional reference on the controller before calling the deregistration path. The driver releases that reference only after completing its own teardown work, keeping the backing memory alive for the duration of cleanup.

Root Cause

The root cause is incorrect reference counting between the spi-imx driver and the SPI core. The driver assumes the controller and driver data persist throughout remove(), but the SPI core frees them inside spi_unregister_controller() when allocations are not device-managed. Subsequent accesses target freed slab memory.

Attack Vector

Exploitation requires the ability to trigger driver unbind on an affected i.MX system. This is typically a local, privileged operation through sysfs unbind or module removal. A local attacker with sufficient privileges could race the freed allocation with controlled allocations to influence the contents of freed slab memory, escalating impact from denial of service toward memory corruption. Remote exploitation is not applicable because the trigger requires local device management actions.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream patch commits referenced by the kernel stable tree.

Detection Methods for CVE-2026-45996

Indicators of Compromise

• Kernel oops or panic messages referencing spi_imx, spi_unregister_controller, or slab use-after-free reports from KASAN during driver unbind or module removal
• Unexpected kernel crashes on i.MX-based hardware correlated with device hot-unplug, echo to sysfs unbind, or rmmod spi_imx
• KASAN reports highlighting freed objects allocated by the SPI core being accessed by spi-imx code paths

Detection Strategies

• Build test kernels with KASAN enabled in lab environments and exercise repeated bind/unbind cycles of the spi-imx driver to surface the bug
• Inspect installed kernel package versions across i.MX fleet devices and compare against fixed stable branches referenced in the kernel.org commits
• Review crash dumps and dmesg archives for stack traces traversing spi_imx_remove followed by SPI core teardown

Monitoring Recommendations

• Centralize kernel logs from embedded i.MX devices and alert on oops, BUG, or KASAN report signatures involving SPI subsystem symbols
• Track kernel package inventory and patch status for all Linux-based edge and industrial devices that ship the spi-imx driver
• Monitor for unexpected module load/unload events on production embedded systems where such activity is not part of normal operation

How to Mitigate CVE-2026-45996

Immediate Actions Required

• Apply the upstream Linux kernel patches referenced in the kernel.org stable commits for your active kernel branch
• Restrict access to root and to sysfs paths that allow driver unbind on production i.MX systems
• Disable unprivileged module loading and unloading where operationally feasible

Patch Information

The fix is committed to the Linux kernel stable tree across multiple maintenance branches. Relevant commits include 132e47030b0b, 1c78c2002380, 385a330083f8, aa9025a49803, and f99165ef0677. See the Linux kernel stable commit 132e47030b0b and the Linux kernel stable commit f99165ef0677 for the patch contents. Rebuild and deploy kernels containing these commits to all affected i.MX devices.

Workarounds

• Avoid unbinding or removing the spi-imx driver at runtime on unpatched kernels
• Lock down /sys/bus/platform/drivers/spi_imx/unbind permissions and prevent non-root users from invoking module operations
• Where SPI is not required, blacklist the spi_imx module to prevent it from loading in the first place

# Prevent runtime unbind by removing write access to the unbind sysfs node
chmod 000 /sys/bus/platform/drivers/spi_imx/unbind

# Optionally blacklist the module if SPI is unused on the platform
echo "blacklist spi_imx" | sudo tee /etc/modprobe.d/blacklist-spi-imx.conf
sudo update-initramfs -u