Linux Kernel EUVD-2026-32846

Vendor-released patch: update to a fixed Linux stable release - per EUVD this includes 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.140, 6.12.90, 6.18.32, 7.0.9, and 7.1-rc1 or later, depending on the branch in use. The fix is the upstream commits referenced at git.kernel.org/stable (notably 6c3e413919a1, 706b3dc2ac7a, bb6b50f709c5, bbcd6dd8e9f2, ee52da0dd83e), which add a cancel_work_sync after disabling interrupts in the spi-mpc52xx unbind path. Distribution users should pull the corresponding vendor kernel update (RHEL/Ubuntu/SUSE/Debian errata). If patching must be deferred on affected PowerPC MPC52xx systems, the practical compensating control is to avoid unbinding the spi-mpc52xx driver at runtime (do not write to /sys/bus/platform/drivers/mpc52xx-psc-spi/unbind or rmmod the module) and restrict root/CAP_SYS_ADMIN access that would permit such an operation; on systems that never need this driver, blacklisting the module entirely (modprobe blacklist) removes the attack surface at the cost of losing SPI functionality on that hardware.