CVE-2026-46241: Linux MPC52xx SPI Controller Use-After-Free Privilege Escalation

Technical summary

The vulnerability exists in the mpc52xx SPI controller driver's initialization path. During controller registration, if an error occurs after interrupts have been allocated but before successful registration completion, the error handling path does not call the necessary disable and free functions for those interrupts. This leaves interrupt pointers in memory that reference freed structures, creating a classic use-after-free condition (CWE-416). An attacker with local access and sufficient privileges could potentially dereference these stale pointers to read or write kernel memory, or trigger a denial of service.

Business impact

For organizations running Linux systems with MPC52xx SPI controllers—common in embedded and industrial control systems—this vulnerability creates a localized privilege escalation risk. A local attacker could leverage the use-after-free to gain kernel-level code execution or cause system instability. The impact is highest in multi-tenant or shared-access environments where untrusted local users exist. Systems deployed in critical infrastructure, IoT gateways, and embedded devices with SPI-based peripherals face elevated risk if registration failures occur during normal operation or after system updates.

Affected systems

Linux kernel systems with the MPC52xx SPI controller driver are affected. This includes PowerPC-based embedded systems and industrial platforms that rely on this controller for SPI communication with peripheral devices. The vulnerability affects all kernel versions containing the vulnerable code path prior to the fix being merged upstream.

Exploitability

The vulnerability requires local access and unprivileged user-level privileges to trigger, as indicated by the CVSS vector (AV:L/PR:L). An attacker must first cause or wait for a controller registration failure—a relatively infrequent event in normal operation. However, an attacker with local code execution could intentionally trigger registration failures by manipulating driver parameters or hardware state. Once triggered, exploiting the use-after-free requires dereferencing the stale pointer, which is non-trivial but feasible for a skilled attacker familiar with kernel internals. Remote exploitation is not possible; this is strictly a local privilege escalation vector.

Remediation

Apply the upstream Linux kernel patch that adds proper interrupt cleanup in the MPC52xx controller's error handling path. The fix ensures that if registration fails, the disable and free interrupt functions are invoked to properly release resources and prevent the use-after-free condition. Verify that your kernel includes the fix by checking your kernel version against upstream releases after the published date, or consult your Linux distribution's security advisories for backported patches.

Patch guidance

Check your Linux distribution's security advisory for a patched kernel version. Upstream kernel maintainers have resolved this issue; verify that your kernel version incorporates the MPC52xx SPI controller registration failure fix. For systems unable to immediately update, assess whether the MPC52xx SPI controller is actively used; if not in use or if the system is sufficiently isolated, risk is reduced but not eliminated. Test patches in a non-production environment first, particularly on embedded systems where SPI controllers are integral to device operation.

Detection guidance

Monitor kernel logs for SPI controller registration errors or failures. Systems that encounter repeated registration failures for the MPC52xx controller should be examined for exploitation attempts. Use kernel memory sanitization tools (KASAN, KMSAN) if available in your build to detect use-after-free access patterns. Check running kernel version with 'uname -r' and cross-reference against patched versions from your distribution. For systems with verbose audit logging, examine attempts to access SPI device interfaces by unprivileged users immediately following registration failures.

Why prioritize this

This vulnerability scores HIGH (7.8) due to its potential for local privilege escalation with significant system impact (confidentiality, integrity, and availability). While it requires local access and occurs only on registration failure—reducing overall attack surface compared to remote vulnerabilities—the ability to achieve kernel-level code execution from an unprivileged user account makes it a priority for systems with multi-user or untrusted-application scenarios. Embedded and industrial systems using MPC52xx controllers should prioritize patching to prevent supply-chain or firmware-update-triggered exploitation.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects HIGH severity: local attack vector (AV:L) with low complexity (AC:L) and low privilege requirement (PR:L) yield a base score of 7.1; however, the vulnerability affects all three security properties—confidentiality, integrity, and availability (C:H/I:H/A:H)—pushing the score to 7.8. This appropriately captures the risk of kernel memory read/write or denial of service, tempered by the requirement for local presence and the infrequent nature of registration failures in typical deployments.

Frequently asked questions