CVE-2026-46083

spi: fix resource leaks on device setup failure

MEDIUM

5.5

CVSS Score

Published: May 27, 2026 at 12:58 PM UTC

Updated: October 15, 2026 at 02:19 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: spi: fix resource leaks on device setup failure Make sure to call controller cleanup() if spi_setup() fails while registering a device to avoid leaking any resources allocated by setup().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.10.44 ≤ v < 5.115.12.11 ≤ v < 5.135.13.1 ≤ v < 6.1.1765.4.126 ≤ v < 5.56.13 ≤ v < 6.18.276.19 ≤ v < 7.0.46.2 ≤ v < 6.6.1406.7 ≤ v < 6.12.863e7c190475d98099231ee8ae486d31b1e2e7535a4b8b7bc3a726268e5c15d9bafe27863a85fdfc8e5.10.44 5.12.11 5.13 5.13 rc4 5.13 rc5 5.13 rc6 5.13 rc7 5.4.126c7299fea67696db5bd09d924d1f1080d894f92efe92ac9263b06c39f05526ad15c90d228cdab60fd

Vendor states this is fixed in 11baa8b24bcb07ae2048f2566a220021d766abe0 (fixed)

Vendor states this is fixed in 1e774294b2f944f59e03a04eb438768a4b93c3ce (fixed)

Vendor states this is fixed in a2c817c629430fbbd54273525b472dac96e2c8fd (fixed)

Vendor states this is fixed in db357034f7e0cf23f233f414a8508312dfe8fbbe (fixed)

Vendor states this is fixed in dbcead54b12468d9aa54c0e1f0042d838ec3b0ae (fixed)

Vendor states this is fixed in e0401de43dac00f3e4841ca2aeb98bc10a4c5f13 (fixed)

Affected range stops below 5.11, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.13 (unaffected)

Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.1.176 (unaffected)

Vendor states this is fixed in 6.12.86 (unaffected)

Vendor states this is fixed in 6.18.27 (unaffected)