Linux CVE-2026-23475

The vulnerability exists in the Linux kernel's SPI (Serial Peripheral Interface) controller subsystem. The issue involves improper lifetime management of per-CPU statistics data structures used for performance monitoring. The SPI controller framework allocates statistics using devres (device resource management) but performs this allocation after the controller is registered with the Linux driver core. During the registration window, kernel code permits sysfs attribute access before the statistics buffer is initialized, resulting in dereferencing a NULL pointer when userspace reads performance counters from /sys/devices/platform/spi_*/statistics/. The fix relocates statistics allocation to occur during controller allocation rather than relying on implicit devres cleanup, ensuring the data structure is available before any sysfs interface becomes accessible. This is a resource lifecycle and state management issue within the kernel's bus abstraction layer.