Linux Kernel EUVD-2026-58891

The Linux kernel's spi-uniphier driver (drivers/spi/spi-uniphier.c) uses a struct completion to synchronize interrupt-driven SPI transfer completion with process context. During the driver probe path, the upstream code registered the interrupt handler via devm_request_irq() prior to calling init_completion() on the completion variable used by that handler. This creates a time-of-use-before-initialization window: if an SPI interrupt fires immediately after IRQ registration but before init_completion() executes, the handler calls complete() on memory that has not yet been set up as a valid completion object. The kernel's KASAN (Kernel Address Sanitizer) can detect this as an uninitialized-memory access. Structurally this matches CWE-908 (Use of Uninitialized Resource) and constitutes a probe-time race condition. Affected hardware is exclusively Socionext UniPhier ARM SoC platforms; only kernels built with spi-uniphier driver support (CONFIG_SPI_UNIPHIER) are vulnerable. The fix is a one-line reordering: init_completion() must precede devm_request_irq() in probe.