CVE-2026-31487

A flaw was found in the Linux kernel, specifically within its Serial Peripheral Interface (SPI) subsystem. This vulnerability arises from improper handling of memory when a driver is being attached, leading to a use-after-free (UAF) condition. A UAF vulnerability is a type of memory corruption that can allow a local attacker to potentially escalate privileges or cause a system crash, impacting system stability and security.

The SPI bus now uses the generic driver_override infrastructure so match() without the device lock cannot race unlocked reads of driver_override. Red Hat defers concrete privilege claims to per-product exploitability testing. Apply kernel errata when available; SPI is widely compiled in, so patching is the practical control.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.