Skip to main content

Linux Kernel EUVDEUVD-2026-24857

| CVE-2026-31489 HIGH
Double Free (CWE-415)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-2pvh-447j-v7m6
Information Disclosure Linux
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Generated
Apr 28, 2026 - 13:07 vuln.today
CVSS changed
Apr 28, 2026 - 13:07 NVD
7.8 (HIGH)
Patch released
Apr 28, 2026 - 12:57 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24857
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

spi: meson-spicc: Fix double-put in remove path

meson_spicc_probe() registers the controller with devm_spi_register_controller(), so teardown already drops the controller reference via devm cleanup.

Calling spi_controller_put() again in meson_spicc_remove() causes a double-put.

AnalysisAI

Use-after-free in Linux kernel meson-spicc SPI driver allows local authenticated attackers to escalate privileges or crash the system. The vulnerability stems from a double-put reference counting error during driver removal - devm_spi_register_controller() already handles cleanup automatically, but meson_spicc_remove() explicitly calls spi_controller_put() again, releasing the same memory twice. EPSS probability is low (0.02%, 5th percentile), no active exploitation confirmed, and vendor patches are available across multiple kernel versions (6.12.80, 6.18.21, 6.19.11, 7.0). This targets systems using Amlogic Meson SoC SPI controllers, requiring local authenticated access to exploit.

Technical ContextAI

The meson-spicc driver manages SPI controllers on Amlogic Meson system-on-chips. It uses the Linux device-managed resource framework (devm_*) for automatic cleanup. The vulnerability is CWE-415 (Double Free), where meson_spicc_probe() registers the SPI controller via devm_spi_register_controller(), which ties the controller's lifecycle to the device and automatically calls spi_controller_put() during device removal. However, meson_spicc_remove() manually calls spi_controller_put() again, decrementing the reference count twice and potentially freeing the same memory region. This creates a use-after-free condition exploitable if an attacker can trigger driver removal (via module unload or device unbind) while other kernel code still references the controller structure. The affected CPE entries indicate vulnerability exists in kernel versions from 5.14 through 7.0-rc1, with fixes backported to stable branches 6.12.80, 6.18.21, and 6.19.11.

RemediationAI

Upgrade to patched Linux kernel versions: 6.12.80 or later in the 6.12.x series, 6.18.21 or later in 6.18.x, 6.19.11 or later in 6.19.x, or 7.0 stable release. Patches available via upstream commits 40ad0334c17b23d8b66b1082ad1478a6202e90e2, 63542bb402b7013171c9f621c28b609eda4dbf1f, 9b812ceb75a6260c17c91db4b9e74ead8cfa06f5, and da06a104f0486355073ff0d1bcb1fcbebb7080d6. For systems unable to patch immediately, limit local user access to trusted administrators only and disable dynamic module loading (sysctl kernel.modules_disabled=1) to prevent driver reload attacks, though this prevents loading any kernel modules and requires reboot for changes. Monitor for unexpected driver removal events via kernel logs. Restricting access to /sys/bus/platform/drivers/meson-spicc/unbind may reduce attack surface but breaks legitimate device management workflows.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2023-25136 MEDIUM POC
6.5
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8
CVE-2017-6074 HIGH POC
7.8
CVE-2017-9287 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-24857 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy