CVE-2026-46200: Linux Kernel MPC52xx SPI Vulnerability

CVE-2026-46200 Overview

CVE-2026-46200 is a Linux kernel vulnerability in the spi-mpc52xx Serial Peripheral Interface (SPI) controller driver. The flaw involves incorrect ordering of resource cleanup during driver unbind. The driver released underlying resources such as interrupts and General Purpose Input/Output (GPIO) lines before deregistering the SPI controller. This sequence creates a window where the controller remains visible to the kernel while its backing resources are gone.

Critical Impact
Improper teardown order in the mpc52xx SPI driver can lead to use-after-free conditions or kernel instability when the driver is unbound while the controller is still in use.

Affected Products

Linux kernel builds including the spi-mpc52xx driver prior to the fix
Systems based on Freescale/NXP MPC52xx PowerPC platforms using SPI
Stable kernel branches referenced by commits 0f997fda, 28f28a0f, 7fea80d9, and a3669f67

Discovery Timeline

2026-05-28 - CVE-2026-46200 published to the National Vulnerability Database (NVD)
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46200

Vulnerability Analysis

The issue resides in the unbind path of the spi-mpc52xx controller driver in the Linux kernel. During driver removal, the existing code disabled interrupts and freed GPIO resources before calling the SPI controller deregistration routine. The SPI subsystem expects the controller to be torn down first so that no further transfers can be queued or completed against resources that no longer exist.

When the order is reversed, a transfer in flight or a late completion callback may try to access freed interrupt handlers or released GPIO descriptors. The result is undefined kernel behavior, ranging from warnings and oopses to potential memory corruption.

Root Cause

The root cause is incorrect lifecycle management in the driver's remove callback. The fix reorders cleanup so that spi_unregister_controller() runs first, ensuring the SPI core stops dispatching work to the driver before any underlying hardware resources are released.

Attack Vector

Triggering the condition requires the ability to unbind or unload the spi-mpc52xx driver while the controller has active or pending operations. This is typically a local, privileged operation. No remote attack vector is described in the upstream advisory, and no known exploitation has been reported.

For patch-level technical context, see the upstream commits: Linux kernel commit 0f997fda, commit 28f28a0f, commit 7fea80d9, and commit a3669f67.

Detection Methods for CVE-2026-46200

Indicators of Compromise

Kernel oops or warning messages referencing spi-mpc52xx, spi_unregister_controller, or freed interrupt handlers after driver unbind
Stack traces involving SPI completion callbacks following a modprobe -r or device unbind event
Unexpected GPIO or interrupt-related faults on MPC52xx-based hardware following driver lifecycle operations

Detection Strategies

Audit installed kernel versions against the fixed stable branches referenced by the upstream commits
Monitor dmesg and persistent kernel logs for WARN, BUG, or Oops entries tied to SPI teardown paths
Track driver bind and unbind events on embedded systems where spi-mpc52xx is in use

Monitoring Recommendations

Forward kernel logs from affected MPC52xx systems to a centralized log platform for review of SPI-related faults
Alert on kernel panics or repeated soft lockups on systems that load the spi-mpc52xx module
Include kernel package versions in configuration inventory to confirm patch state across the fleet

How to Mitigate CVE-2026-46200

Immediate Actions Required

Update affected Linux systems to a stable kernel that contains the fix commits listed in the NVD entry
On embedded MPC52xx deployments, schedule a kernel update through the platform vendor or distribution channel
Restrict ability to load, unload, or unbind kernel drivers to administrative users only

Patch Information

The fix reorders the unbind path so that the SPI controller is deregistered before interrupts and GPIOs are released. Apply a kernel build that includes commits 0f997fda, 28f28a0f, 7fea80d9, or a3669f67.

Workarounds

Avoid unbinding or unloading the spi-mpc52xx driver on production systems until the patched kernel is deployed
Where the driver is not required, blacklist the spi-mpc52xx module to prevent it from loading
Limit local privileged access on affected MPC52xx hardware to reduce the chance of triggering the unbind path

bash

# Verify kernel version and check for the spi-mpc52xx driver
uname -r
lsmod | grep spi_mpc52xx

# Optional: prevent the driver from loading on systems that do not need it
echo "blacklist spi_mpc52xx" | sudo tee /etc/modprobe.d/blacklist-spi-mpc52xx.conf
sudo update-initramfs -u