CVE-2026-45996

HighCVSS 7.8/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: imx: fix use-after-free on unbind

The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed).

Take another reference before deregistering the controller so that the driver data is not freed until the driver is done with it.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 307c897db762d1e0feee9477276b08f6deca4a5b, < c7c40c3e7b9fb900504aa746de3e53c5275b24bd; >= 307c897db762d1e0feee9477276b08f6deca4a5b, < f99165ef067723221472ce1aff632bc74f562643; >= 307c897db762d1e0feee9477276b08f6deca4a5b, < 385a330083f8dd47c15b02e9a83aef9234a37003; >= 307c897db762d1e0feee9477276b08f6deca4a5b, < 132e47030b0b5e398e0da6c59df5a5dae9b52cff; >= 307c897db762d1e0feee9477276b08f6deca4a5b, < aa9025a498036b6012769f7af36d421385386c17; >= 307c897db762d1e0feee9477276b08f6deca4a5b, < 1c78c2002380a1fe31bfb01a3d5f29809e55a096
LinuxLinux5.19

References

Timeline

Published
May 27, 2026
Last modified
Nov 6, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-459975.5In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails If dCVE-2026-459987.8In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() CVE-2026-459997.1In the Linux kernel, the following vulnerability has been resolved: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Some craCVE-2026-46009.1Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameCVE-2026-460005.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix conn-level packet handling to unshare RESPONSE packets The CVE-2026-460017.8In the Linux kernel, the following vulnerability has been resolved: hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Fix two bugs inCVE-2026-460025.5In the Linux kernel, the following vulnerability has been resolved: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() exCVE-2026-460035.5In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the total number of nodes Currently, the nameservCVE-2026-460047.8In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setupCVE-2026-460055.5In the Linux kernel, the following vulnerability has been resolved: xfs: fix a resource leak in xfs_alloc_buftarg() In the error path, calCVE-2026-460067.8In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check nouveau_geCVE-2026-460075.5In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Avoid cacheline sharing for DMA buffer Depending on th
CVE-2026-45996: High severity, CVSS 7.8 | Vulnix