Linux Kernel CVE-2026-46228

Exploitation requires: (1) a CH341 USB SPI device physically attached to the target system so the spi-ch341 driver binds; (2) local access with at minimum low-privilege user rights (PR:L per CVSS); (3) the ability to trigger driver unbind without physical device removal - specifically through probe deferral, USB configuration changes, or equivalent driver lifecycle events. Exploitation is limited by: the requirement that a CH341 device be present and the spi-ch341 module loaded; no network-accessible attack surface (AV:L, strictly local); the gradual nature of the impact (memory exhaustion over repeated cycles rather than immediate denial of service); and no confidentiality or integrity consequence. Systems without CH341 hardware or with the module blacklisted are entirely unaffected.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 Medium, reflecting local access with low privilege as prerequisites, no confidentiality or integrity impact, and high availability impact from memory exhaustion. These metrics are consistent with a memory leak triggered by driver lifecycle operations. EPSS at 0.02% (4th percentile) strongly reinforces that this is not being actively targeted. There is no CISA KEV listing and no POC referenced. The 'Information Disclosure' tag in the source intelligence appears inconsistent with the actual vulnerability description and CVSS impact vector (C:N/I:N/A:H); the true impact is availability degradation, not data exposure - this discrepancy should be noted and the tag treated as erroneous. Real-world risk is low: exploitation requires local system access and either a CH341 device attached or the ability to trigger USB configuration events. This is primarily a kernel stability and resource hygiene issue rather than a security-critical threat.

A local user with access to a Linux system hosting a CH341 USB SPI device triggers repeated driver unbind events - for example, by inducing probe deferral through configuration changes or by cycling USB device configurations without physically disconnecting the hardware. Each unbind cycle leaks the SPI controller and associated devres allocations into the parent USB device's resource list, gradually exhausting kernel memory. No public exploit code exists, and this scenario requires physical or administrative access to USB hardware.