Skip to main content

Linux Kernel CVE-2026-46241

| EUVDEUVD-2026-32759 HIGH
Use After Free (CWE-416)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-529r-6cww-q8vr
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local shell on MPC5200 system
  2. Delivery
    Trigger spi-mpc52xx probe
  3. Exploit
    Force controller registration failure
  4. Execution
    IRQ handler remains on freed controller
  5. Persist
    Incoming SPI interrupt dereferences freed memory
  6. Impact
    Kernel memory corruption or info leak

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local access (CVSS AV:L) with at least low privileges (PR:L) on a Linux system running the spi-mpc52xx driver for Freescale MPC5200 PowerPC SoC SPI controllers - almost exclusively embedded hardware. The vulnerable code path only executes when spi_register_controller() fails during the driver's probe sequence, so the attacker must be able to induce or race that failure (e.g., via repeated bind/unbind or resource exhaustion) and have the driver bound to hardware. No exploitation is possible on systems where the spi-mpc52xx module is not loaded or where the underlying MPC5200 SPI hardware is absent. No user interaction is required once the failing-probe condition is reached.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) reflects local access with low privileges and high impact across CIA, which is the standard NVD scoring template for kernel UAF flaws. Real-world risk is significantly lower than the score suggests: EPSS is 0.02% (5th percentile), the bug is not in CISA KEV, no public exploit is identified, and exploitation depends on a code path that only executes on systems using the SPI controller on Freescale MPC5200 hardware - an embedded PowerPC platform with a very small modern footprint. The window for triggering UAF is the controller registration failure path, which is not attacker-reachable in a normal boot, further limiting practical exploitability. This is best treated as routine kernel hardening rather than an urgent priority for general-purpose Linux fleets.
Exploit ScenarioDerived

A local low-privileged user on an embedded MPC5200 PowerPC system would need to provoke the spi-mpc52xx controller registration to fail (for example by repeatedly forcing module load/unload or constraining resources), causing the driver to free the controller while leaving an interrupt handler registered against the freed memory. A subsequent interrupt could then operate on attacker-influenced freed memory, potentially leading to kernel memory corruption or information disclosure. No public proof-of-concept is available.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 10, 2026

Use-after-free in the Linux kernel SPI controller driver for Freescale MPC52xx (spi-mpc52xx) occurs when controller registration fails and the previously requested interrupts are not properly disabled or released, leaving dangling interrupt handlers tied to freed memory. Local users with the ability to load or interact with this SPI driver on affected systems could potentially trigger memory corruption or information disclosure. EPSS is 0.02% and there is no public exploit identified at time of analysis, but the issue is rated CVSS 7.8 due to high impact on confidentiality, integrity, and availability.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.12.90, 6.18.32, 7.0.9, or 7.1-rc1 (or later) from the stable trees, or apply the upstream commits 336d9ad7560b, 5c77f11b9b5f, 8b49b6aadd0c, and f62c060272b9 referenced at https://git.kernel.org/stable/c/336d9ad7560b3baba17af06727a888040ee93390 and the sibling git.kernel.org URLs in the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-46241). For systems that cannot patch immediately, a workable compensating control is to avoid loading the spi-mpc52xx module on systems that do not require it (blacklist it in /etc/modprobe.d/) - the trade-off is loss of SPI bus access on Freescale MPC5200-based hardware that actually depends on the driver. Restricting which local users can load kernel modules (CAP_SYS_MODULE) and tightening physical and console access also reduce the already small attack surface, with no functional side effects for typical deployments.

Affected VersionsENISA

Linux patch: 7.1-rc1
Linux 42bbb70980f3720b0ae6da6af862af0e95a04351 <336d9ad7560b3baba17af06727a888040ee93390
Linux 42bbb70980f3720b0ae6da6af862af0e95a04351 <f62c060272b9d7423b1650b844e8e4e7b8f9f925
Linux 42bbb70980f3720b0ae6da6af862af0e95a04351 <8b49b6aadd0c622ca7d68b4a53ae10362e221cf3
Linux patch: 6.12.90
Linux patch: 0
Linux patch: 7.0.9
Linux 42bbb70980f3720b0ae6da6af862af0e95a04351 <5c77f11b9b5f1ad5a704dad875260c44016ede10
Linux 2.6.33
Linux patch: 6.18.32

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lies in drivers/spi/spi-mpc52xx.c, the Linux SPI master controller driver for the Freescale MPC5200 PowerPC SoC family. On the error path after a failed call to spi_register_controller(), the driver previously did not call free_irq()/disable IRQ for interrupts it had already registered, so the kernel could later invoke the registered ISR against memory belonging to the freed controller structure - a textbook CWE-416 Use-After-Free. This pattern was spotted while reviewing a related controller deregistration fix and is being corrected by reordering the error path to tear down interrupts before freeing the controller.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.5 MEDIUM

Local low-priv access, AC:H because the attacker must race a probe-failure path; integrity/availability high via UAF, confidentiality only low as leaks are incidental.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 10, 2026 - 21:07 NVD
7.8 (HIGH)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
HIGH 7.8
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

spi: mpc52xx: fix use-after-free on registration failure

Make sure to disable and free the interrupts in case controller registration fails to avoid a potential use-after-free and resource leak.

This issue was flagged by Sashiko when reviewing a controller deregistration fix.

Executive ViewAI

Why It Matters

The Linux kernel Freescale MPC52xx SPI controller driver contains a use-after-free vulnerability (CVE-2026-46241, CVSS 7.8) enabling local privilege escalation with potential impact to system confidentiality, integrity, and availability. Although no public exploit identified at time of analysis, affected systems remain vulnerable to insider threats or compromised local accounts. A vendor patch is available and should be deployed to eliminate this local attack vector.

Business Impact: High
Compensating Controls

Apply vendor patch. Interim mitigations if patching delayed: restrict kernel module loading to administrators, disable spi-mpc52xx driver if operationally unnecessary, and audit local user access on affected systems.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46241 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/366740 REF https://git.kernel.org/stable/c/336d9ad7560b3baba17af06727a888040ee93390 REF https://git.kernel.org/stable/c/5c77f11b9b5f1ad5a704dad875260c44016ede10 REF https://git.kernel.org/stable/c/8b49b6aadd0c622ca7d68b4a53ae10362e221cf3 REF https://git.kernel.org/stable/c/b25eb3d24d03e571f09c04a0522c798ea35e48a1 REF https://git.kernel.org/stable/c/dd74a790818ebb9a2be3a94ac935a374755cd278 REF https://git.kernel.org/stable/c/f62c060272b9d7423b1650b844e8e4e7b8f9f925

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy