Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel 6.6.157.1-1 can cause system crash
published 6 months ago
Summary
The Linux kernel version 6.6.157.1-1 has a coding mistake that could let a driver access memory it shouldn't, potentially leading to a crash or instability. Updating to the latest kernel release that includes the fix will protect your systems from this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | kernel |
<= 6.6.157.1-1 <= 6.6.152.1-1 |
| Azure Linux:3 | azure | kernel | <= 6.6.150.1-1 |
Original advisory text
CVE-2026-31487 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:
spi: use generic driver_override infrastructure
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Also note that we do not enable the driver_override feature of struct
bus_type, as SPI - in contrast to most other buses - passes "" to
sysfs_emit() when the driver_override pointer is NULL. Thus, printing
"\n" instead of "(null)\n".
spi: use generic driver_override infrastructure
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Also note that we do not enable the driver_override feature of struct
bus_type, as SPI - in contrast to most other buses - passes "" to
sysfs_emit() when the driver_override pointer is NULL. Thus, printing
"\n" instead of "(null)\n".
References
Timeline
Published22 Apr 2026
Updated24 Sep 2026
First seen23 Sep 2026
Sources
AZL-83195 · OSV
Track software like this
Free during beta