CVE-2026-46074: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46074 Overview

CVE-2026-46074 is a Linux kernel vulnerability in the spi: ch341 USB-to-SPI bridge driver. The flaw involves memory leaks and a use-after-free condition triggered when the driver's probe routine fails. The probe path did not deregister the SPI controller, disable pins, or kill and free the RX URB to mirror the disconnect path. As a result, kernel resources tied to a USB CH341 device could remain registered or be referenced after release. The upstream fix realigns the probe error path with disconnect and adds an explicit URB kill on disconnect for symmetry.

Critical Impact
Probe failures on the CH341 SPI driver can leak kernel memory and trigger use-after-free on the RX URB, leading to potential kernel memory corruption or denial of service.

Affected Products

Linux kernel branches containing the spi-ch341 driver prior to the fix commits
Systems that load the CH341 USB-to-SPI driver when a CH341-based USB adapter is attached
Stable kernel trees referenced by the upstream commits 5c6518633702, 9bee2faf9e21, b99e3ddb91b4, and ff8a7996dc8b

Discovery Timeline

2026-05-27 - CVE-2026-46074 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46074

Vulnerability Analysis

The vulnerability resides in the spi: ch341 driver, which exposes the WCH CH341 USB device as a Serial Peripheral Interface (SPI) controller in Linux. During probe(), the driver registers an SPI controller, configures pins, and submits an RX USB Request Block (URB) to receive data from the device. The original code did not unwind these allocations correctly when a later probe step failed.

When a probe error occurred, the SPI controller remained registered, GPIO pins remained configured, and the RX URB was neither killed nor freed. The URB callback could then fire against freed driver state, producing a use-after-free. The leaked controller and URB allocations also accumulate across repeated probe failures, providing a memory exhaustion path.

Root Cause

The root cause is asymmetric resource management between the probe() and disconnect() handlers. The disconnect path correctly tore down the SPI controller, pins, and URB, while the probe error path did not. The fix mirrors disconnect inside the probe error handler and adds an explicit usb_kill_urb() in disconnect for symmetry.

Attack Vector

Exploitation requires a CH341 USB device or an emulated USB descriptor that causes the spi-ch341 probe routine to fail after URB submission. A local user with physical USB access, or an attacker controlling a programmable USB peripheral, can trigger probe failures repeatedly to leak memory or race the URB completion against freed state. There is no known network attack vector and no public exploit at the time of publication.

No verified public code examples are available. See the Kernel Commit 5c651863370 and Kernel Commit ff8a7996dc8 for the exact source-level changes.

Detection Methods for CVE-2026-46074

Indicators of Compromise

Kernel log entries referencing spi-ch341 probe failures followed by KASAN or SLUB use-after-free reports against URB structures.
Unexpected growth of kmalloc-* slabs after repeated insertion or rebinding of CH341 USB devices.
USB device enumeration events for vendor 0x1a86 (WCH) product 0x5512 paired with driver bind failures in dmesg.

Detection Strategies

Enable KASAN on test kernels to surface use-after-free in the ch341_spi RX URB completion path.
Monitor dmesg for spi_register_controller errors followed by missing teardown messages.
Audit USB hotplug telemetry for repeated probe and disconnect cycles tied to CH341 hardware.

Monitoring Recommendations

Track kernel oops, WARN, and KASAN events through centralized logging.
Alert on systems where untrusted users have physical USB access and CH341 drivers are loaded.
Inventory hosts that ship the spi-ch341 module to scope patch deployment.

How to Mitigate CVE-2026-46074

Immediate Actions Required

Apply the upstream stable patches referenced by commits 5c6518633702, 9bee2faf9e21, b99e3ddb91b4, and ff8a7996dc8b to all affected kernel branches.
Until patched, unload the spi-ch341 module on systems that do not require CH341 USB-to-SPI functionality.
Restrict physical USB access on multi-user systems where the driver remains loaded.

Patch Information

The fix is contained in the upstream Linux kernel commits 5c6518633702, 9bee2faf9e21, b99e3ddb91b4, and ff8a7996dc8b. The change deregisters the SPI controller, disables pins, and calls usb_kill_urb() followed by usb_free_urb() on the probe error path, and adds an explicit URB kill on disconnect.

Workarounds

Blacklist the spi-ch341 module on hosts that do not require CH341 hardware by adding blacklist spi-ch341 to a file under /etc/modprobe.d/.
Use USB authorization policies via /sys/bus/usb/devices/*/authorized to deny unknown CH341 devices.
Disable USB ports on critical systems where the driver cannot be unloaded.

bash

# Configuration example
echo 'blacklist spi-ch341' | sudo tee /etc/modprobe.d/disable-ch341.conf
sudo modprobe -r spi-ch341 2>/dev/null || true
sudo update-initramfs -u