CVE-2026-46083: Linux Kernel SPI Resource Leak Vulnerability

CVE-2026-46083 Overview

CVE-2026-46083 is a resource leak vulnerability in the Linux kernel's Serial Peripheral Interface (SPI) subsystem. The flaw occurs during SPI device registration when the spi_setup() call fails. The kernel does not invoke the controller's cleanup() callback, leaving resources allocated by the corresponding setup() call unreleased. Maintainers resolved the issue by ensuring cleanup() is called on the failure path during device registration.

Critical Impact
Repeated SPI device registration failures can exhaust kernel memory and controller-specific resources, leading to degraded system stability on systems with SPI peripherals.

Affected Products

Linux kernel SPI subsystem (drivers/spi/spi.c)
Stable kernel branches receiving backports referenced in the upstream commits
Systems and drivers relying on SPI controller setup()/cleanup() callbacks

Discovery Timeline

2026-05-27 - CVE-2026-46083 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46083

Vulnerability Analysis

The Linux kernel SPI core exposes controller-level callbacks setup() and cleanup() to allow drivers to allocate and release per-device resources. During device registration, the core calls spi_setup() to initialize the device. If spi_setup() returns an error after setup() has already allocated resources, the corresponding cleanup() callback was not invoked. Any memory, DMA mappings, or driver-private state allocated by setup() remained referenced by no owner and leaked.

The defect is classified as a memory leak [CWE-401]. It is triggered along an error path, so its impact scales with how often SPI device registration fails. Conditions that trigger the leak include invalid transfer parameters, controller-specific constraints rejected by spi_setup(), and probe sequences for misconfigured device tree entries.

The fix updates the registration flow to call the controller cleanup() whenever spi_setup() fails, restoring symmetry between the allocation and release callbacks.

Root Cause

The root cause is asymmetric error handling in the SPI device registration path. The setup() callback acquires resources, but the failure branch of spi_setup() returns without releasing them. The patch enforces the invariant that any successful setup() is paired with a cleanup() even when subsequent registration steps fail.

Attack Vector

The issue is a reliability and resource exhaustion defect rather than a remote exploitation primitive. Triggering the leak requires the ability to cause repeated SPI device registration failures, typically through local privileged operations such as loading drivers, manipulating device tree overlays, or hot-plugging SPI peripherals. No remote network attack vector is documented. See the upstream fixes at Kernel Git Commit 11baa8b, Kernel Git Commit 1e77429, Kernel Git Commit a2c817c, Kernel Git Commit db35703, and Kernel Git Commit dbcead5.

// No verified exploit code is available for this CVE.
// The defect is an error-path memory leak fixed by invoking the
// controller cleanup() callback when spi_setup() fails during
// SPI device registration.

Detection Methods for CVE-2026-46083

Indicators of Compromise

Repeated kernel log entries reporting SPI device registration or spi_setup() failures
Gradual growth of kernel slab allocations associated with SPI controller drivers
DMA descriptor or controller resource exhaustion warnings on systems with SPI peripherals

Detection Strategies

Audit running kernel versions against the fixed commits referenced in the upstream advisories
Use kmemleak on debug kernels to identify unreleased allocations originating from SPI setup() callbacks
Correlate dmesg output containing SPI probe failures with increases in /proc/slabinfo counters

Monitoring Recommendations

Track kernel version inventory across Linux fleets and flag hosts running unpatched stable branches
Monitor long-running embedded and server systems for unexplained kernel memory growth
Alert on bursts of SPI driver probe failures in centralized logging pipelines

How to Mitigate CVE-2026-46083

Immediate Actions Required

Apply the upstream Linux kernel patches that invoke cleanup() when spi_setup() fails during registration
Update to a stable kernel release that includes the referenced commits for your distribution
Restrict the ability to load or rebind SPI drivers to privileged administrators only

Patch Information

The fix is distributed across multiple stable branches. Review and apply the upstream commits: Kernel Git Commit 11baa8b, Kernel Git Commit 1e77429, Kernel Git Commit a2c817c, Kernel Git Commit db35703, and Kernel Git Commit dbcead5. Consume the fix through your Linux distribution's security updates when available.

Workarounds

Avoid configurations that produce recurring SPI device registration failures, including invalid device tree entries
Schedule periodic reboots on long-running unpatched systems exhibiting kernel memory growth tied to SPI activity
Disable unused SPI controllers in firmware or kernel configuration to reduce exposure until patches are applied

bash

# Verify current kernel version and check for the SPI cleanup fix
uname -r
git log --oneline drivers/spi/spi.c | grep -i "cleanup"

# Inspect SPI probe failures and resource state
dmesg | grep -i spi
cat /proc/slabinfo | grep -i spi