CVE-2026-31389 addresses a use-after-free vulnerability in the Linux kernel's SPI controller registration process. Specifically, if the allocation of per-CPU statistics fails during controller registration, the driver core was not properly deregistered, causing use-after-free of driver resources and unlocked register accesses. This flaw was resolved by ensuring proper deregistration in such failure scenarios. The vulnerability affects Linux kernel versions prior to 6.8.x releases as specified. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a local attacker with low privileges can cause high impact on confidentiality, integrity, and availability. The vendor has released patches in updated kernel versions, and users are advised to update and reboot. The update involves an ABI change requiring recompilation of third-party kernel modules. This fix is part of a broader security update addressing multiple kernel vulnerabilities.

The vulnerability allows a local attacker with low privileges to exploit a use-after-free condition during SPI controller registration failure, potentially leading to high impact on system confidentiality, integrity, and availability. Exploitation could result in unauthorized access to sensitive information, corruption of kernel memory, or system instability. No known exploits are currently reported in the wild.

An official patch is available and included in Linux kernel versions 6.8.0 and later (specific patched versions include 6.8.0-1064.72 and above). Users should update their Linux kernel to a fixed version and reboot the system to apply the changes. Due to an ABI change in the kernel update, recompilation and reinstallation of any third-party kernel modules are required. Follow the vendor's update instructions carefully to ensure full remediation.