In the Linux kernel, the following vulnerability has been resolved:

spi: fix statistics allocation

The controller per-cpu statistics is not allocated until after the
controller has been registered with driver core, which leaves a window
where accessing the sysfs attributes can trigger a NULL-pointer
dereference.

Fix this by moving the statistics allocation to controller allocation
while tying its lifetime to that of the controller (rather than using
implicit devres).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < 80c5bd0dca1cc5526ae0f4b273ccd163ed4caa4e
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < f13100b1f5f111989f0750540a795fdef47492af
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < df30056c78e8bead02d4be020199cabdbec0fef1
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < 378b295f67102eef78cf2c28105f60ae1dab5cc1
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < 118ce777d39f03cac99231196f820e4f998613a8
6598b91b5ac32bc756d7c3000a31f775d4ead1c4 affected < dee0774bbb2abb172e9069ce5ffef579b12b3ae9
Linux Linux affected
Version Status Constraints
6.0 affected —
0 unaffected < 6.0
6.1.167 unaffected ≤ 6.1.*
6.6.130 unaffected ≤ 6.6.*
6.12.78 unaffected ≤ 6.12.*
6.18.20 unaffected ≤ 6.18.*
6.19.10 unaffected ≤ 6.19.*
7.0-rc5 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/118ce777d39f03cac99231196f820e4f998613a8 cve-icon cve-icon
https://git.kernel.org/stable/c/378b295f67102eef78cf2c28105f60ae1dab5cc1 cve-icon cve-icon
https://git.kernel.org/stable/c/80c5bd0dca1cc5526ae0f4b273ccd163ed4caa4e cve-icon cve-icon
https://git.kernel.org/stable/c/dee0774bbb2abb172e9069ce5ffef579b12b3ae9 cve-icon cve-icon
https://git.kernel.org/stable/c/df30056c78e8bead02d4be020199cabdbec0fef1 cve-icon cve-icon
https://git.kernel.org/stable/c/f13100b1f5f111989f0750540a795fdef47492af cve-icon cve-icon
History

Fri, 03 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: spi: fix statistics allocation The controller per-cpu statistics is not allocated until after the controller has been registered with driver core, which leaves a window where accessing the sysfs attributes can trigger a NULL-pointer dereference. Fix this by moving the statistics allocation to controller allocation while tying its lifetime to that of the controller (rather than using implicit devres).
Title spi: fix statistics allocation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-04-03T15:15:54.211Z

Reserved: 2026-01-13T15:37:46.022Z

Link: CVE-2026-23475

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-03T16:16:35.440

Modified: 2026-04-03T16:16:35.440

Link: CVE-2026-23475

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.