CVE-2026-31485

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> spi: spi-fsl-lpspi: fix teardown order issue (UAF)<br /> <br /> There is a teardown order issue in the driver. The SPI controller is<br /> registered using devm_spi_register_controller(), which delays<br /> unregistration of the SPI controller until after the fsl_lpspi_remove()<br /> function returns.<br /> <br /> As the fsl_lpspi_remove() function synchronously tears down the DMA<br /> channels, a running SPI transfer triggers the following NULL pointer<br /> dereference due to use after free:<br /> <br /> | fsl_lpspi 42550000.spi: I/O Error in DMA RX<br /> | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000<br /> [...]<br /> | Call trace:<br /> | fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]<br /> | fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]<br /> | spi_transfer_one_message+0x49c/0x7c8<br /> | __spi_pump_transfer_message+0x120/0x420<br /> | __spi_sync+0x2c4/0x520<br /> | spi_sync+0x34/0x60<br /> | spidev_message+0x20c/0x378 [spidev]<br /> | spidev_ioctl+0x398/0x750 [spidev]<br /> [...]<br /> <br /> Switch from devm_spi_register_controller() to spi_register_controller() in<br /> fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in<br /> fsl_lpspi_remove().