Skip to main content

Linux Kernel EUVDEUVD-2026-32846

| CVE-2026-46219 HIGH
Use After Free (CWE-416)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-993q-fvmm-5hv9
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local shell on MPC52xx Linux host
  2. Delivery
    Obtain privileges to unbind platform driver
  3. Exploit
    Trigger spi-mpc52xx unbind during active SPI I/O
  4. Execution
    Stale IRQ-scheduled work executes on freed state
  5. Persist
    Corrupt kernel memory via UAF
  6. Impact
    Escalate privileges or crash kernel

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local access to a Linux system running a kernel that has the spi-mpc52xx driver loaded - in practice, embedded PowerPC MPC52xx-class hardware - and the ability to trigger driver unbind (writing to the driver's sysfs unbind attribute or removing the module), which normally requires root/CAP_SYS_ADMIN. The race must be hit while the interrupt handler has a state-machine work item pending, so concurrent SPI activity at unbind time is needed. Exploitation is bounded by: (1) absence of the MPC52xx SPI driver on the vast majority of x86/ARM Linux deployments, (2) PR:L in the CVSS vector indicating some prior privilege is needed, and (3) UI:N but local-only attack vector (AV:L) precluding remote exploitation.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High) and reflects a local, low-privilege, low-complexity bug with high CIA impact - typical for a kernel UAF that could be escalated to arbitrary kernel memory corruption. However, exploitation realism is sharply limited: the affected code path is the MPC52xx PowerPC SPI driver, which is only present on a narrow class of embedded PowerPC systems, and triggering the bug requires the ability to unbind that specific driver (normally a root-only sysfs operation). EPSS is 0.02% (5th percentile), the CVE is not on the CISA KEV list, and no public exploit is identified. The tag set mentions 'Information Disclosure' but the CVSS vector and CWE-416 point primarily to memory corruption / privilege escalation potential rather than info disclosure - this is a minor signal mismatch worth noting. Net assessment: real but very low-priority issue except on PowerPC MPC52xx-based fleets, where it should be patched as part of normal stable-kernel uptake.
Exploit ScenarioDerived

A local attacker with the privileges needed to unbind a platform driver (typically root via sysfs unbind or module removal) on a PowerPC MPC52xx system unbinds spi-mpc52xx while SPI activity is in flight; an in-flight IRQ-scheduled work item then runs against freed driver state, producing a kernel UAF that can be shaped into kernel memory corruption and potential privilege escalation or denial of service. No public POC is known, and the attack is constrained to systems that actually load this PowerPC SPI driver.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 10, 2026

Use-after-free in the Linux kernel's MPC52xx SPI driver (spi-mpc52xx) can be triggered when the driver is unbound, because the interrupt-scheduled state machine work is not cancelled after interrupts are disabled. Local users with the ability to unbind the driver could potentially corrupt kernel memory, with confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02%.

RemediationAI

Vendor-released patch: update to a fixed Linux stable release - per EUVD this includes 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.140, 6.12.90, 6.18.32, 7.0.9, and 7.1-rc1 or later, depending on the branch in use. The fix is the upstream commits referenced at git.kernel.org/stable (notably 6c3e413919a1, 706b3dc2ac7a, bb6b50f709c5, bbcd6dd8e9f2, ee52da0dd83e), which add a cancel_work_sync after disabling interrupts in the spi-mpc52xx unbind path. Distribution users should pull the corresponding vendor kernel update (RHEL/Ubuntu/SUSE/Debian errata). If patching must be deferred on affected PowerPC MPC52xx systems, the practical compensating control is to avoid unbinding the spi-mpc52xx driver at runtime (do not write to /sys/bus/platform/drivers/mpc52xx-psc-spi/unbind or rmmod the module) and restrict root/CAP_SYS_ADMIN access that would permit such an operation; on systems that never need this driver, blacklisting the module entirely (modprobe blacklist) removes the attack surface at the cost of losing SPI functionality on that hardware.

Affected VersionsENISA

Linux 373d55a47dc662e5e30d12ad5d334312f757c1f1
Linux f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59 <bb6b50f709c5a01906ff72a07fdc070bb3357188
Linux patch: 6.12.90
Linux 6.13
Linux 6.1.120 <6.2
Linux 5.4.287 <5.5
Linux 90b72189de2cddacb26250579da0510b29a8b82b <ee52da0dd83ebcd89ecbbe2660c57b15a25489f2
Linux d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1
Linux 6.12.5 <6.12.90
Linux 984836621aad98802d92c4a3047114cf518074c8 <6c3e413919a12627d04a31a4a5fccb9fc129bb02
Linux patch: 7.1-rc1
Linux patch: 6.6.140
Linux 984836621aad98802d92c4a3047114cf518074c8 <bbcd6dd8e9f264440eaf6167382bf404911c1c46
Linux patch: 0
Linux 5.15.174 <5.16
Linux e0c6ce8424095c2da32a063d3fc027494c689817
Linux 5.10.231 <5.11
Linux 6.6.66 <6.6.140
Linux patch: 6.18.32
Linux cd5106c77d6d6828aa82449f01f4eb436d602a21
Linux patch: 7.0.9
Linux 984836621aad98802d92c4a3047114cf518074c8 <706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0

Affected Packages

euvd linux fix: 5.5, 5.11, 5.16, 6.2, 6.6.140, 6.12.90

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in drivers/spi/spi-mpc52xx.c, the Linux kernel SPI controller driver for Freescale/NXP MPC52xx PowerPC SoCs. The driver uses an interrupt handler that schedules a deferred work item (a state-machine workqueue task) to advance SPI transfers. On driver unbind, the teardown ordering was incorrect: pending work could still be queued or executing after the backing data structures were freed, which is the classic CWE-416 use-after-free pattern. The fix reorders teardown so interrupts are masked first and then the work item is cancelled (cancel_work_sync) before resources are released, eliminating the race between the IRQ-scheduled worker and the freeing path. CPE data confirms the affected component is the Linux kernel itself (cpe:2.3:o:linux:linux_kernel), with fixes flowing through multiple stable branches.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 10, 2026 - 18:52 NVD
7.8 (HIGH)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
HIGH 7.8
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

spi: mpc52xx: fix use-after-free on unbind

The state machine work is scheduled by the interrupt handler and therefore needs to be cancelled after disabling interrupts to avoid a potential use-after-free.

Executive ViewAI

Why It Matters

A use-after-free vulnerability in the Linux kernel's MPC52xx SPI driver allows local users to corrupt kernel memory, potentially leading to privilege escalation or service disruption. The risk applies specifically to organizations with MPC52xx processors in their infrastructure, and exploitation probability remains very low with no public exploits identified. Patching should be prioritized for affected systems.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46219 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/366717 REF https://git.kernel.org/stable/c/0944b20e9dfa2917bd70eb5b301cbb67fe54a718 REF https://git.kernel.org/stable/c/6c3e413919a12627d04a31a4a5fccb9fc129bb02 REF https://git.kernel.org/stable/c/706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0 REF https://git.kernel.org/stable/c/ac8316c896c79f32c1d0a38cb41fd2b14cf8112e REF https://git.kernel.org/stable/c/bb6b50f709c5a01906ff72a07fdc070bb3357188 REF https://git.kernel.org/stable/c/bbcd6dd8e9f264440eaf6167382bf404911c1c46 REF https://git.kernel.org/stable/c/ed929d40963073f23cfb50219ccbcc6e0c3ea641 REF https://git.kernel.org/stable/c/ee52da0dd83ebcd89ecbbe2660c57b15a25489f2

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy