CVE-2026-23431
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Amlogic SPI driver (amlogic-spisg) in the Linux kernel, a memory leak occurs in aml_spisg_probe(). After allocating a controller via spi_alloc_target() or spi_alloc_host(), several error paths fail to call spi_controller_put().
Risk Assessment
Memory leak can exhaust system resources and cause kernel instability, especially during repeated driver probe attempts.
Recommendation
Apply the patch that switches to devm-managed allocation (devm_spi_alloc_host/devm_spi_alloc_target), which automatically frees memory on error.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Fix memory leak in aml_spisg_probe() In aml_spisg_probe(), ctlr is allocated by spi_alloc_target()/spi_alloc_host(), but fails to call spi_controller_put() in several error paths. This leads to a memory leak whenever the driver fails to probe after the initial allocation. Convert to use devm_spi_alloc_host()/devm_spi_alloc_target() to fix the memory leak.