LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path

In the Linux kernel, the following vulnerability has been resolved: spi: spi-sprd-adi: Fix double free in probe error path The driver currently uses spi_alloc_host() to allocate the controller but registers it using devm_spi_register_controller(). If devm_register_restart_handler() fails, the code jumps to the put_ctlr label and calls spi_controller_put(). However, since the controller was registered via a devm function, the device core will automatically call spi_controller_put() again when the probe fails. This results in a double-free of the spi_controller structure. Fix this by switching to devm_spi_alloc_host() and removing the manual spi_controller_put() call.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a double-free bug in the spi-sprd-adi driver during device probe failure handling. It matters mainly for systems that include and use this specific SPI controller driver. The source bundle does not provide CVSS, exploitation evidence, or business-impact detail.

Executive priority

Treat as a targeted kernel maintenance item, not an internet-wide emergency based on current evidence. Prioritize embedded, mobile, or custom Linux fleets that may use this driver, and align remediation with normal kernel patch cycles unless vendor guidance escalates it.

Technical view

The driver allocates an SPI controller with spi_alloc_host() but registers it with devm_spi_register_controller(). If devm_register_restart_handler() fails, manual cleanup calls spi_controller_put(), then device-managed cleanup can call it again, causing a double free. The fix switches to devm_spi_alloc_host() and removes manual put cleanup.

Likely exposure

Exposure appears limited to Linux kernels that include the affected spi-sprd-adi driver and encounter the relevant probe error path. The bundle lists affected Linux versions and commits, but does not identify distributions, devices, or default configurations.

Exploitation context

The provided sources do not report active exploitation, public exploit availability, or CISA KEV listing. The issue is kernel-level memory safety, but the bundle does not establish remote reachability or practical exploitability.

Researcher notes

Evidence is narrow: the public description explains the root cause and fix, but gives no CVSS, CWE, exploitation, or distro mapping. Validation should focus on driver presence, kernel lineage, and whether the stable commits are present in downstream kernels.

Mitigation direction

  • Apply kernel or distribution updates that include the referenced stable fixes.
  • Check vendor or distribution advisories for exact fixed package versions.
  • Prioritize custom kernels that include spi-sprd-adi support.
  • If the driver is unnecessary, follow vendor guidance on disabling it.

Validation and detection

  • Inventory kernels and compare against the affected versions listed in the CVE record.
  • Check whether spi-sprd-adi is built, packaged, or loaded on relevant systems.
  • Verify deployed kernel source or changelog includes one referenced stable commit.
  • Confirm restart-handler probe failure handling no longer performs duplicate controller cleanup.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23068 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxac1775012058e13ef1522938e27f5973d9e3f053, ac1775012058e13ef1522938e27f5973d9e3f053, ac1775012058e13ef1522938e27f5973d9e3f053, ac1775012058e13ef1522938e27f5973d9e3f053, ac1775012058e13ef1522938e27f5973d9e3f053unaffected
LinuxLinux4.17, 0, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.