CVE-2026-46228
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in the Linux kernel related to the management of USB device resource lifetimes in SPI drivers has been fixed. Memory leaks could occur when drivers were unbound without physically disconnecting devices.
Risk Assessment
Organizations may be exposed to memory leaks, which can lead to decreased system performance and potential application stability issues.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability and improve resource management in USB drivers.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the controller and driver data lifetime so that they are released on driver unbind. Note that this also makes sure that the SPI controller is placed correctly under the USB interface in the device tree.