CVE-2026-90433

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the oc-tiny SPI driver where the controller is allocated using the non-managed spi alloc host() function while the interrupt is registered via devm request irq(). During the removal process, the controller and its associated driver-private data are freed before the interrupt handler is fully drained. This sequence allows a late or latched interrupt to trigger the tiny spi irq() function, leading to a dereference of already-freed memory, such as hw->base.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.