CVE-2025-39893 Details
Description
In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: unregister ECC engine on probe error and device remove The on-host hardware ECC engine remains registered both when the spi_register_controller() function returns with an error and also on device removal. Change the qcom_spi_probe() function to unregister the engine on the error path, and add the missing unregistering call to qcom_spi_remove() to avoid possible use-after-free issues.
A vulnerability exists in the Linux kernel's SPI QPIC SNAND driver, where the on-host hardware ECC engine remains registered during error conditions and device removal. This oversight can lead to use-after-free issues. The vulnerability has been addressed by modifying the probe function to properly unregister the ECC engine on errors and adding the missing unregistration call during device removal.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1991a458528588ff34e98b6365362560d208710f | kernel.org | Patch |
| https://git.kernel.org/stable/c/e4de48e66af17547727bb2e4b1867952817edff7 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.15, < 6.16.6 6.17 rc1 6.17 rc2 6.17 rc3 6.17 rc4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 14, 2026 | CVE Modified | CISA-ADP |
| Dec 12, 2025 | Initial Analysis | [email protected] |
| Oct 1, 2025 | New CVE Received | kernel.org |