Security readout for executives and security teams
Plain-English summary
A Linux SPI controller registration error can leave freed driver resources registered with the kernel. Later access could crash the system or potentially let a locally authenticated attacker compromise confidentiality, integrity, and availability. The triggering allocation failure is described as unlikely.
Executive priority
Prioritize prompt, risk-based patching for multi-user, embedded, industrial, and high-availability Linux systems using SPI. This is not shown as remotely or actively exploited, so emergency internet-edge response is unsupported. Asset identification may require extra effort because the supplied affected-version representation is ambiguous.
Technical view
If per-CPU statistics allocation fails during SPI controller registration, the affected error path does not deregister the controller from the driver core. This can cause use-after-free of driver resources and access to hardware registers without a clock. Stable kernel commits add the missing deregistration cleanup.
Likely exposure
Exposure requires an affected Linux kernel and the SPI controller registration failure path. The supplied CVSS indicates local access with low privileges, not remote network exploitation. Exact affected version ranges are unclear in the bundled version data, so kernel lineage and vendor backports must be checked.
Exploitation context
The bundle reports CVSS 7.8 with potential high confidentiality, integrity, and availability impact. It does not establish that attackers can reliably induce the allocation failure. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The core defect and cleanup change are well described, but exploitability details are limited. Determine whether an unprivileged local actor can influence memory pressure or SPI controller registration in the target configuration. Treat the listed hashes and version values cautiously; use stable commits and vendor backport records to establish exposure. The bundle does not identify a CWE.
Mitigation direction
- Install a vendor-supported kernel update containing the relevant stable fix or backport.
- Map each deployed kernel to its distribution or equipment-vendor advisory before declaring it unaffected.
- Restrict unnecessary local accounts and privileges while affected systems await updates.
- Review the linked Siemens advisories for any applicable embedded or industrial products.
Validation and detection
- Inventory kernel versions, distribution builds, and systems using SPI-connected hardware.
- Confirm the installed kernel contains the applicable stable fix or documented vendor backport.
- Review kernel logs for SPI registration failures, use-after-free warnings, or invalid register access.
- Validate the corrected registration-failure cleanup in a non-production environment.
- Re-scan affected assets after updating and record the fixed package version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31389 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0e23f50086da7d0b183dfeac26021acfcdee086bCVE reference, Linux
- https://git.kernel.org/stable/c/6bbd385b30c7fb6c7ee0669e9ada91490938c051CVE reference, Linux
- https://git.kernel.org/stable/c/afe27c1f43aa57530011f419be6ddf71306565d2CVE reference, Linux
- https://git.kernel.org/stable/c/80f3e8cd2b4ad355b2ad2024cf423f6d183404f7CVE reference, Linux
- https://git.kernel.org/stable/c/23b51bad2eb8787aa74324cfccefb258515ae5baCVE reference, Linux
- https://git.kernel.org/stable/c/8634e05b08ead636e926022f4a98416e13440df9CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.