High 7.8Published May 28, 2026

CVE-2026-46241spi: mpc52xx: fix use-after-free on registration failure

Updated under an hour ago (Oct 27, 2026, 3:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix use-after-free on registration failure Make sure to disable and free the interrupts in case controller registration fails to avoid a potential use-after-free and resource leak. This issue was flagged by Sashiko when reviewing a controller deregistration fix.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 42bbb70980f3720b0ae6da6af862af0e95a04351 before dd74a790818ebb9a2be3a94ac935a374755cd278; 42bbb70980f3720b0ae6da6af862af0e95a04351 builds before 8b49b6aadd0c622ca7d68b4a53ae10362e221cf3; from 42bbb70980f3720b0ae6da6af862af0e95a04351 before 336d9ad7560b3baba17af06727a888040ee93390; 42bbb70980f3720b0ae6da6af862af0e95a04351 builds before 5c77f11b9b5f1ad5a704dad875260c44016ede10; from 42bbb70980f3720b0ae6da6af862af0e95a04351 before f62c060272b9d7423b1650b844e8e4e7b8f9f925	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.33 before 6.12.90; from 6.13 before 6.18.32; from 6.19 before 7.0.9	NVD

References

References

https://git.kernel.org/stable/c/dd74a790818ebb9a2be3a94ac935a374755cd278
https://git.kernel.org/stable/c/8b49b6aadd0c622ca7d68b4a53ae10362e221cf3	patch
https://git.kernel.org/stable/c/336d9ad7560b3baba17af06727a888040ee93390	patch
https://git.kernel.org/stable/c/5c77f11b9b5f1ad5a704dad875260c44016ede10	patch
https://git.kernel.org/stable/c/f62c060272b9d7423b1650b844e8e4e7b8f9f925	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.