Linux CVE-2026-31389

This vulnerability exists in the Linux kernel's SPI subsystem core (spi/core.c or equivalent). The root cause is a missing error-handling path: when spi_controller_register() attempts to allocate per-CPU statistics during device registration and that allocation fails, the function returns an error without properly deregistering the device from the driver core. This leaves the device registered with the core but in a partially-initialized state. Subsequent access attempts reference freed or uninitialized driver resources, leading to use-after-free conditions and potential unclocked register accesses (reads/writes to hardware registers without the clock enabled, causing undefined behavior). The CWE classification is not provided, but this falls under CWE-416 (Use After Free) and CWE-273 (Improper Check for Dropped Privileges). The affected component is the SPI controller registration path, which is architecture-independent and present in all Linux kernel builds with SPI support enabled.