Skip to main content

Linux Kernel CVE-2026-46228

| EUVDEUVD-2026-32855 MEDIUM
Memory Leak (CWE-401)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-qpf5-pj4j-j3vf
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack vector and low privilege required to trigger driver unbind; only availability impacted via memory leak, no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 10, 2026 - 21:39 vuln.today
CVSS changed
Jun 10, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
MEDIUM 5.5
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

spi: ch341: fix devres lifetime

USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes).

Fix the controller and driver data lifetime so that they are released on driver unbind.

Note that this also makes sure that the SPI controller is placed correctly under the USB interface in the device tree.

AnalysisAI

Memory leak in the Linux kernel's spi: ch341 USB-to-SPI driver allows a local user to degrade system availability by triggering driver unbind without physical device disconnection. The defect lies in incorrect devres (device-managed resource) lifetime scoping - resources are anchored to the parent USB device rather than the USB interface, so they are not released when the driver unbinds during events such as probe deferral or runtime configuration changes. No public exploit has been identified at time of analysis, and an EPSS score of 0.02% (4th percentile) indicates negligible exploitation probability in the near term.

Technical ContextAI

The CH341 is a USB bridge chip manufactured by WCH that exposes SPI, I2C, and UART functionality. The Linux kernel's spi: ch341 driver (under drivers/spi/) binds to USB interfaces representing this device. Linux's devres framework ties resource lifetimes to a struct device; for USB interface drivers, resources must be bound to the usb_interface device, not the parent usb_device. When resources are incorrectly allocated against the parent, they survive driver unbind and are never freed unless the physical device is removed - causing memory leaks on probe deferral or USB configuration changes. The root cause class is CWE-401 (Missing Release of Memory after Effective Lifetime). CPE data (cpe:2.3:o:linux:linux_kernel:*) confirms this affects the upstream Linux kernel. The fix also corrects SPI controller placement in the device tree so it appears as a child of the USB interface rather than the USB device.

RemediationAI

The primary remediation is to update to a patched kernel release: Linux 6.18.32, 7.0.9, or 7.1-rc1, which incorporate the devres lifetime fix via upstream stable commits (https://git.kernel.org/stable/c/108a64b27a52f781c4f3751641e3dd65c7dd2fb5, https://git.kernel.org/stable/c/4422fc2411cbbdf5104a914e0596bb483faea254, https://git.kernel.org/stable/c/abe572f630bc1f0e77041012ab075869036ede4f). Distribution-specific kernel updates (Debian, Ubuntu, RHEL, SUSE, etc.) should be monitored for backport availability. As a compensating control for systems where patching is not immediately possible, blacklisting the spi-ch341 kernel module (add 'blacklist spi-ch341' to /etc/modprobe.d/) will prevent the driver from binding and eliminate the leak path - the trade-off is loss of CH341 SPI functionality. Alternatively, avoiding plug/unplug cycles or configuration changes on CH341 devices until patched reduces leak frequency. Long-running systems with frequent driver bind/unbind cycles should be prioritized for patching, as cumulative memory leaks could eventually affect system stability.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-46228 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy