CVE-2026-90433spi: oc-tiny: switch to managed controller allocation
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spi_alloc_host() while the interrupt is registered with devm_request_irq(). During removal, spi_bitbang_stop() only unregisters the controller; the subsequent spi_controller_put() then frees the controller together with its embedded driver-private devdata, which is the IRQ handler's dev_id. The devm_request_irq() release action (free_irq()), which drains the handler, does not run until after .remove() returns. A late or latched interrupt can therefore reach tiny_spi_irq() and dereference already-freed memory (e.g. hw->base). Switch to devm_spi_alloc_host() so that the devres LIFO order releases the controller only after free_irq() has drained the handler, and drop the now-redundant spi_controller_put() from .remove(). The probe error path is simplified to direct returns. This issue was found by an in-house static analysis tool.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 43 days later
· 43 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected ce792580ea2ce6f7259b45124e9ccc4574c31606 – < a2f1c58864fc3612c230a9d5cc1929e1ffe348ac
- affected ce792580ea2ce6f7259b45124e9ccc4574c31606 – < 9265fa8190312b87637def1382d36fc16de3b8e8
- affected ce792580ea2ce6f7259b45124e9ccc4574c31606 – < 0260c94453a08491640e61f8cf0c384edbe7bd11
- affected ce792580ea2ce6f7259b45124e9ccc4574c31606 – < ef5cc4a8c088d05549f71950a72b5deff5000fd7
- affected ce792580ea2ce6f7259b45124e9ccc4574c31606 – < 1cd16c8d68f58e54abb8f331d05469237200631f
- affected ce792580ea2ce6f7259b45124e9ccc4574c31606 – < d710f43ce30975d197f73c543bfe47b958d8ba17
- affected 2.6.39
- unaffected < 2.6.39
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/a2f1c58864fc3612c230a9d5cc1929e1ffe348ac (opens in a new tab)
- https://git.kernel.org/stable/c/9265fa8190312b87637def1382d36fc16de3b8e8 (opens in a new tab)
- https://git.kernel.org/stable/c/0260c94453a08491640e61f8cf0c384edbe7bd11 (opens in a new tab)
- https://git.kernel.org/stable/c/ef5cc4a8c088d05549f71950a72b5deff5000fd7 (opens in a new tab)
- https://git.kernel.org/stable/c/1cd16c8d68f58e54abb8f331d05469237200631f (opens in a new tab)
- https://git.kernel.org/stable/c/d710f43ce30975d197f73c543bfe47b958d8ba17 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-82094 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-90433)Record last updated .