CVE-2026-72048

Linux kernel: ieee802154 ca8210 driver leaks cas_ctl on spi_async failure due to kzalloc_obj(GFP_ATOMIC) allocation that is only freed in the completion callback. On submission failure, spi_async() does not queue a callback, leaving cas_ctl and embedded spi_message/spi_transfer orphaned. The leak...

CVE-2026-68467 mtd: mchp23k256: use SPI match data for chip caps

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses ofdevicegetmatchdata, so a non-OF SPI modalias match falls back t...

EUVD-2026-59089

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses ofdevicegetmatchdata, so a non-OF SPI modalias match falls back t...

CVE-2026-68467 mtd: mchp23k256: use SPI match data for chip caps

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses ofdevicegetmatchdata, so a non-OF SPI modalias match falls back t...

CVE-2026-68467

The CVE-2026-68467 issue affects the Linux kernel mtd: mchp23k256 driver. The driver stored chip capacity in both the OF match table and the SPI id table, and probe used of_device_get_match_data(), which caused an id-table-only match to fallback to mchp23k256_caps. The fix switches to spi_get_dev...

CVE-2026-74415: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: fix use-after-free when driver unbind DMA resource is initialized after SPI controller registration. So when driver unbind, this can trigger a use-after-free when DMA is torn down while the controller is still ali...

PT-2026-72712

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Xilinx SPI driver regarding how the FIFO First-In, First-Out buffer size is determined. The driver incorrectly calculates the size by writing to the TX FIFO regist...

CVE-2026-74276: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

CVE-2026-72133: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls devmrequestirq before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after...

PT-2026-72237

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the ieee802154 driver for the ca8210 device. The function ca8210 spi transfer allocates a cas ctl object using kzalloc objGFP ATOMIC and expects the ca8210 spi...

PT-2026-72341

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crossbar domain free function where the domain data is reset before the irq data-hwirq member is used as an index to reset the irq map entry and update the crossba...

CVE-2026-68467: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses ofdevicegetmatchdata, so a non-OF SPI modalias match falls back t...

PT-2026-72344

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the mpf ops parse header function within the microchip-spi FPGA component. The function reads the header size from the bitstream at the MPF HEADER SIZE...

PT-2026-72340

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tpm tis spi component where the wait event interruptible timeout function evaluates its condition after setting the current task state to TASK INTERRUPTIBLE. When...

PT-2026-72343

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mtd: spi-nor: swp component where attempting to unlock only the specific blocks that are currently locked fails if those are the first few blocks of the device. Th...

PT-2026-72322

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the spi uniphier driver, the devm request irq function is called before the completion used by the interrupt handler is initialized. Since an interrupt can occur immediately after the...

CVE-2026-72153: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbardomainfree crossbardomainfree resets the domain data and then uses the nulled out irqdata-hwirq member as index to reset the irqmap entry and to write the relevant crossbar register...

CVE-2026-72156: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the expression buf + headersize - 1 reads one byte...

CVE-2026-72155: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire...

Linux Distros Unpatched Vulnerability : CVE-2026-72155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the...