Linux Kernel CVE-2026-46225

The affected component is the spi/rspi driver in the Linux kernel, which manages Renesas Serial Peripheral Interface (SPI) controllers. During driver unbind (e.g., module removal or device hotplug events), the cleanup sequence must deregister the SPI controller first to drain pending transfers before releasing underlying DMA channel resources. The bug inverts this order, allowing the SPI subsystem to continue referencing DMA structures that have already been freed. CPE data confirms the affected product as cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, with the vulnerability introduced at commit 9e03d05eee4ca45ed12749ef6c26bf616262cdd2 and present since at least Linux 3.14. Although no CWE is formally assigned, the root cause class most closely aligns with improper resource cleanup ordering, analogous to CWE-459 (Incomplete Cleanup) or CWE-416 (Use After Free), as freed DMA memory can be accessed by the still-registered controller. The 'Information Disclosure' tag in the source data conflicts with the CVSS confidentiality impact of C:N - this tag appears to be a mis-tagging and should not be treated as a confirmed confidentiality risk.