Medium 5.5Published Apr 3, 2026

CVE-2026-23475spi: fix statistics allocation

Updated under an hour ago (Oct 27, 2026, 6:50 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: spi: fix statistics allocation The controller per-cpu statistics is not allocated until after the controller has been registered with driver core, which leaves a window where accessing the sysfs attributes can trigger a NULL-pointer dereference. Fix this by moving the statistics allocation to controller allocation while tying its lifetime to that of the controller (rather than using implicit devres).

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	6598b91b5ac32bc756d7c3000a31f775d4ead1c4 builds before 80c5bd0dca1cc5526ae0f4b273ccd163ed4caa4e; from 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 before f13100b1f5f111989f0750540a795fdef47492af; from 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 before df30056c78e8bead02d4be020199cabdbec0fef1; 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 builds before 378b295f67102eef78cf2c28105f60ae1dab5cc1; 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 builds before 118ce777d39f03cac99231196f820e4f998613a8; from 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 before dee0774bbb2abb172e9069ce5ffef579b12b3ae9	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 6.0 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; 7.0; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/80c5bd0dca1cc5526ae0f4b273ccd163ed4caa4e	patch
https://git.kernel.org/stable/c/f13100b1f5f111989f0750540a795fdef47492af	patch
https://git.kernel.org/stable/c/df30056c78e8bead02d4be020199cabdbec0fef1	patch
https://git.kernel.org/stable/c/378b295f67102eef78cf2c28105f60ae1dab5cc1	patch
https://git.kernel.org/stable/c/118ce777d39f03cac99231196f820e4f998613a8	patch
https://git.kernel.org/stable/c/dee0774bbb2abb172e9069ce5ffef579b12b3ae9	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.