CVE-2026-46228

MediumCVSS 5.5/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: ch341: fix devres lifetime

USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes).

Fix the controller and driver data lifetime so that they are released on driver unbind.

Note that this also makes sure that the SPI controller is placed correctly under the USB interface in the device tree.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2026
Last modified
Oct 21, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-462295.5In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure KFCVE-2026-46237.3A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b00CVE-2026-462307.1In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds aCVE-2026-462315.5In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: put backbone reference on failed claim hash insert WhCVE-2026-462328.1In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A device would never lie aboCVE-2026-462335.5In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: only purge non-released claims When batadv_bla_purge_CVE-2026-462347.8In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order In vsock_update_buffer_size(), tCVE-2026-462355.5In the Linux kernel, the following vulnerability has been resolved: media: saa7164: add ioremap return checks and cleanups Add checks for CVE-2026-462365.5In the Linux kernel, the following vulnerability has been resolved: media: rc: xbox_remote: heed DMA restrictions The buffer for IO must nCVE-2026-462388.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: stop caching unowned originator pointers in BAT IV BAT IV CVE-2026-462395.5In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl Three contrCVE-2026-46247.3A vulnerability was detected in SourceCodester Online Library Management System 1.0. The impacted element is an unknown function of the file
CVE-2026-46228: Medium severity, CVSS 5.5 | Vulnix