The Linux kernel vulnerability in the spi: ch341 driver relates to incorrect devres lifetime management for USB drivers binding to USB interfaces. Device-managed resources were incorrectly tied to the parent USB device instead of the interface, leading to memory leaks during driver unbind events without physical device disconnection (e.g., probe deferral or configuration changes). The patch corrects the lifetime of controller and driver data to be released on driver unbind and ensures proper placement of the SPI controller under the USB interface in the device tree. This resolves resource management issues and prevents memory leaks.

The vulnerability causes memory leaks in the Linux kernel when USB drivers using the spi: ch341 controller are unbound without the physical USB device being disconnected. This can degrade system stability and availability due to resource exhaustion. There is no impact on confidentiality or integrity. The CVSS vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should update to a patched kernel version that includes the corrected devres lifetime management for the spi: ch341 driver. No additional mitigation is required beyond applying the official fix.