CVE-2026-46074

In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix memory leaks on probe failures Make sure to deregister the controller, disable pins, and kill and free the RX URB on probe failures to mirror disconnect and avoid memory leaks and use-after-free. Also add an explicit URB kill on disconnect for symmetry (even if that is not strictly required as USB core would have stopped it in the current setup).

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/5c6518633702d7f7b1153e9d8e042af847f11ef3	Patch
https://git.kernel.org/stable/c/9bee2faf9e21c796d0d222c9d84a98f41bd303a0	Patch
https://git.kernel.org/stable/c/b99e3ddb91b499d920e63a2daff8880be68cfe9e	Patch
https://git.kernel.org/stable/c/ff8a7996dc8bf433efe2126ffdaee5b374a89e30	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-05-27 14:17

Updated : 2026-06-24 16:59

NVD link : CVE-2026-46074

Mitre link : CVE-2026-46074

CVE.ORG link : CVE-2026-46074

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2026-46074", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8846739f52afa07e63395c80227dc544f54bd7b1", "lessThan": "5c6518633702d7f7b1153e9d8e042af847f11ef3", "versionType": "git"}, {"status": "affected", "version": "8846739f52afa07e63395c80227dc544f54bd7b1", "lessThan": "ff8a7996dc8bf433efe2126ffdaee5b374a89e30", "versionType": "git"}, {"status": "affected", "version": "8846739f52afa07e63395c80227dc544f54bd7b1", "lessThan": "9bee2faf9e21c796d0d222c9d84a98f41bd303a0", "versionType": "git"}, {"status": "affected", "version": "8846739f52afa07e63395c80227dc544f54bd7b1", "lessThan": "b99e3ddb91b499d920e63a2daff8880be68cfe9e", "versionType": "git"}], "programFiles": ["drivers/spi/spi-ch341.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.86", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.27", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.4", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/spi/spi-ch341.c"], "defaultStatus": "affected"}]}], "published": "2026-05-27T14:17:28.717", "references": [{"url": "https://git.kernel.org/stable/c/5c6518633702d7f7b1153e9d8e042af847f11ef3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9bee2faf9e21c796d0d222c9d84a98f41bd303a0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b99e3ddb91b499d920e63a2daff8880be68cfe9e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ff8a7996dc8bf433efe2126ffdaee5b374a89e30", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ch341: fix memory leaks on probe failures\n\nMake sure to deregister the controller, disable pins, and kill and free\nthe RX URB on probe failures to mirror disconnect and avoid memory\nleaks and use-after-free.\n\nAlso add an explicit URB kill on disconnect for symmetry (even if that\nis not strictly required as USB core would have stopped it in the\ncurrent setup)."}], "lastModified": "2026-06-24T16:59:17.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BE3B9C6-D36E-42AC-BB24-7D1BF41C0DD0", "versionEndExcluding": "6.12.86", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74", "versionEndExcluding": "6.18.27", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}