CVE-2026-46225: Linux Kernel RSPI Privilege Escalation

CVE-2026-46225 Overview

CVE-2026-46225 is a Linux kernel vulnerability in the Renesas Serial Peripheral Interface (rspi) driver. The flaw involves incorrect ordering during driver unbind: the SPI controller was not deregistered before underlying resources such as Direct Memory Access (DMA) channels were released. This ordering issue can leave references to freed resources active while the controller is still exposed to consumers.

The patch ensures the controller is deregistered first, then DMA and other underlying resources are torn down. This eliminates the window where in-flight transfers or new requests could interact with released DMA state.

Critical Impact

Improper teardown ordering in the rspi driver can lead to use-after-free conditions on DMA resources during driver unbind, potentially causing kernel instability.

Affected Products

• Linux kernel spi-rspi driver (Renesas SPI controller)
• Linux stable kernel branches receiving the referenced backports
• Systems using Renesas SoC platforms with SPI/DMA enabled

Discovery Timeline

• 2026-05-28 - CVE-2026-46225 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46225

Vulnerability Analysis

The spi-rspi driver implements support for Renesas SPI controllers in the Linux kernel. During driver unbind, cleanup routines previously released backing resources such as DMA channels before calling the SPI core to deregister the controller.

While the controller remains registered, the SPI subsystem can still dispatch transfers or accept new messages from consumers. If DMA structures have already been torn down at that point, the driver operates on stale or freed pointers. This produces undefined behavior, including kernel oops, memory corruption, or use-after-free conditions on freed DMA descriptors.

The fix reorders unbind so that spi_unregister_controller() runs first. Once the controller is removed from the SPI core, no further transfers can be queued, making it safe to release DMA channels and remaining hardware resources.

Root Cause

The root cause is incorrect resource lifecycle management in the driver remove path. The code released subordinate resources before unregistering the parent object that exposes them. This is a classic ordering bug between subsystem deregistration and resource teardown in kernel driver code.

Attack Vector

Triggering the condition requires the ability to unbind the rspi driver or remove its module while SPI activity is in progress. This is typically a local, privileged operation. The realistic impact is kernel instability and denial of service on affected embedded platforms, rather than remote exploitation.

No verified public exploit code is available. The vulnerability is described in the kernel commit messages referenced in the Linux stable tree.

Detection Methods for CVE-2026-46225

Indicators of Compromise

• Kernel oops or panic traces referencing rspi, spi_unregister_controller, or DMA release functions during module unload or device unbind.
• dmesg warnings about use-after-free or invalid DMA descriptors on Renesas SPI-enabled hardware.
• Unexpected system instability correlated with hotplug, suspend/resume, or driver reload events on affected SoCs.

Detection Strategies

• Inventory running kernel versions against the fixed commits: 77defd64, 9944fa67, aee76c1d, c5090db1, and fee6abd9 in the Linux stable tree.
• Audit systems for the presence of the spi-rspi module via lsmod and verify whether they run a patched kernel build.
• Review kernel crash dumps and kdump artifacts on Renesas-based fleets for stack traces involving SPI teardown.

Monitoring Recommendations

• Forward kernel logs to a centralized logging or SIEM platform and alert on BUG:, WARNING:, or Oops strings tied to rspi or spi-core symbols.
• Track unplanned reboots and kernel crashes on embedded Renesas platforms as potential indicators of driver lifecycle bugs.

How to Mitigate CVE-2026-46225

Immediate Actions Required

• Apply the upstream Linux kernel patches referenced in the NVD entry to all affected stable branches.
• Rebuild and redeploy custom or vendor kernels that ship the spi-rspi driver to include the fix.
• Restrict the ability to unbind or unload SPI drivers to trusted administrators on production systems.

Patch Information

The vulnerability is resolved by upstream commits that reorder controller deregistration ahead of DMA resource release. See Kernel Git Commit aee76c1d, Kernel Git Commit 77defd64, Kernel Git Commit 9944fa67, Kernel Git Commit c5090db1, and Kernel Git Commit fee6abd9.

Workarounds

• Avoid unbinding or unloading the spi-rspi driver on running production systems until a patched kernel is deployed.
• Where the SPI controller is not required, disable CONFIG_SPI_RSPI in the kernel configuration and rebuild.
• Limit local privileged access on affected embedded devices to reduce opportunities to trigger the unbind path.