spi: ch341: fix devres lifetime
In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the controller and driver data lifetime so that they are released on driver unbind. Note that this also makes sure that the SPI controller is placed correctly under the USB interface in the device tree.
CVE-2026-46228
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-46228
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "8846739f52afa07e63395c80227dc544f54bd7b1",
"lessThan": "42dfcd2ced905ea3993d88a051c13e04ab1029f7",
"versionType": "git"
},
{
"status": "affected",
"version": "8846739f52afa07e63395c80227dc544f54bd7b1",
"lessThan": "4422fc2411cbbdf5104a914e0596bb483faea254",
"versionType": "git"
},
{
"status": "affected",
"version": "8846739f52afa07e63395c80227dc544f54bd7b1",
"lessThan": "108a64b27a52f781c4f3751641e3dd65c7dd2fb5",
"versionType": "git"
},
{
"status": "affected",
"version": "8846739f52afa07e63395c80227dc544f54bd7b1",
"lessThan": "abe572f630bc1f0e77041012ab075869036ede4f",
"versionType": "git"
}
],
"programFiles": [
"drivers/spi/spi-ch341.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/spi/spi-ch341.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-46228
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46333 · Revision 1
- Added to Heist Feed
- Publisher date