CVE-2026-46219: Linux Kernel MPC52xx SPI Use-After-Free Vulnerability

Technical summary

CVE-2026-46219 is a use-after-free (CWE-416) in the mpc52xx SPI controller driver within the Linux kernel. The vulnerability occurs during device unbind when the driver fails to cancel pending work queue items after disabling interrupts. Because the interrupt handler schedules asynchronous state machine work, a window exists where the work item may execute after the driver's state has been freed. This is a classic race condition between interrupt disabling and work queue cancellation, exposing a pointer dereference to already-deallocated memory.

Business impact

Exploitation could allow a local, privileged user to crash the kernel or potentially achieve privilege escalation through controlled memory corruption. On systems using MPC52xx SPI devices (primarily embedded and automotive platforms), this vulnerability can lead to denial of service. Since the flaw requires local access and Linux privilege context, it primarily impacts multi-user systems, embedded devices with untrusted local users, or scenarios where an attacker has already obtained limited local execution capability.

Affected systems

All Linux kernel versions containing the mpc52xx SPI driver are affected. This driver is used on platforms with Freescale/NXP MPC52xx SoCs, common in embedded, automotive, and industrial applications. The impact scope is narrower than generic kernel vulnerabilities due to hardware specificity, but any deployment running the mpc52xx driver with local users at privilege levels capable of triggering driver unbind operations is at risk.

Exploitability

The vulnerability requires local access and Linux process privileges (not root, per CVSS vector PR:L), making it exploitable by authenticated local users. However, it is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no public weaponized exploits are currently documented. Exploiting this requires either triggering deliberate driver unbind operations (e.g., via sysfs) or waiting for natural unbind events; it is not remotely exploitable and does not require user interaction.

Remediation

Patch the Linux kernel to include the fix that ensures work queue tasks are cancelled after interrupt disabling during driver unbind. Verify the fix by confirming that cancel_work_sync() or equivalent is called on the state machine work item before freeing driver state. Systems unable to patch immediately should evaluate whether the mpc52xx driver is necessary; if not, blacklist or remove the module. For embedded deployments, restrict local user privileges and disable unnecessary driver functionality where feasible.

Patch guidance

Apply the latest Linux kernel security update or stable release containing the mpc52xx SPI driver fix. Coordinate patching with your kernel vendor's advisories. Verify via kernel changelog or commit history that the unbind path now explicitly cancels pending work. Test on development systems with identical hardware to confirm driver functionality remains correct after patching. Kernel rebuilds should include this patch if custom kernel configurations are used.

Detection guidance

Monitor system logs for kernel NULL pointer dereference or use-after-free warnings (e.g., BUG messages, KASAN reports) occurring during SPI driver unbind or module unload operations. In production, enable kernel address sanitizer (KASAN) or use dynamic analysis tools in lab environments to detect memory safety violations. Correlate crashes with sysfs operations on mpc52xx devices (/sys/bus/spi/devices/). Network-based detection is not applicable; monitoring must occur on affected hosts.

Why prioritize this

Assign this vulnerability a high priority within SPI-dependent environments and embedded/automotive deployments using MPC52xx hardware. The HIGH CVSS score (7.8) reflects the potential for kernel crash and memory corruption. However, prioritization should be contextualized: organizations without MPC52xx hardware can deprioritize; those with such systems should treat it as medium-to-high priority depending on local user exposure. The lack of public exploits currently limits immediate operational urgency, but the availability of a fix warrants near-term patching.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects attack vector Local, low complexity, requirement for limited privilege, no user interaction, and High impact to confidentiality, integrity, and availability. The score appropriately captures the severity of use-after-free and kernel memory corruption. However, the real-world risk is modulated by narrow hardware applicability and the requirement for local privilege, making this less severe than a comparable remote or privilege-escalation-free vulnerability affecting all systems.

Frequently asked questions