{"id":"CVE-2026-90433","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: oc-tiny: switch to managed controller allocation\n\nThe controller is allocated with the non-managed spi_alloc_host() while\nthe interrupt is registered with devm_req…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: oc-tiny: switch to managed controller allocation\n\nThe controller is allocated with the non-managed spi_alloc_host() while\nthe interrupt is registered with devm_req…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ce792580ea2ce6f7259b45124e9ccc4574c31606 < 0260c94453a08491640e61f8cf0c384edbe7bd11","Linux >= ce792580ea2ce6f7259b45124e9ccc4574c31606 < ef5cc4a8c088d05549f71950a72b5deff5000fd7","Linux >= ce792580ea2ce6f7259b45124e9ccc4574c31606 < 1cd16c8d68f58e54abb8f331d05469237200631f","Linux >= ce792580ea2ce6f7259b45124e9ccc4574c31606 < d710f43ce30975d197f73c543bfe47b958d8ba17","Linux 2.6.39"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:48.400","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90433","references":[{"url":"https://git.kernel.org/stable/c/0260c94453a08491640e61f8cf0c384edbe7bd11","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1cd16c8d68f58e54abb8f331d05469237200631f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d710f43ce30975d197f73c543bfe47b958d8ba17","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef5cc4a8c088d05549f71950a72b5deff5000fd7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.790Z","epss":0.00168,"epssPercentile":0.06454,"slug":"CVE-2026-90433","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: oc-tiny: switch to managed controller allocation\n\nThe controller is allocated with the non-managed spi_alloc_host() while\nthe interrupt is registered with devm_request_irq().  During removal,\nspi_bitbang_stop() only unregisters the controller; the subsequent\nspi_controller_put() then frees the controller together with its\nembedded driver-private devdata, which is the IRQ handler's dev_id.  The\ndevm_request_irq() release action (free_irq()), which drains the\nhandler, does not run until after .remove() returns.  A late or latched\ninterrupt can therefore reach tiny_spi_irq() and dereference\nalready-freed memory (e.g. hw->base).\n\nSwitch to devm_spi_alloc_host() so that the devres LIFO order releases\nthe controller only after free_irq() has drained the handler, and drop\nthe now-redundant spi_controller_put() from .remove().  The probe error\npath is simplified to direct returns.\n\nThis issue was found by an in-house static analysis tool.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}