CVE-2026-23068

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel driver for spi-sprd-adi contains a flaw where a double-free of the spi controller structure can occur. This happens when devm register restart handler() fails, causing the code to call spi controller put(). Because the controller was registered using a devm function, the device core also calls spi controller put(), leading to the double-free. The issue arises from using spi alloc host() for allocation and devm spi register controller() for registration.

Recommendations Switch to using devm spi alloc host() and remove the manual spi controller put() call.