{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"6e8eb467bed6aa1a563dba8f366c9fd76ba0004e","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"c73a58661a760373d08a6883af4f0bb5cc991a67","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-31487","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \"\" to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\"\\n\" instead of \"(null)\\n\".","epss":{"date":"2026-11-05","percentile":0.01808,"score":0.0012},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915101645,"publishedAt":1776866052290,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/6e8eb467bed6aa1a563dba8f366c9fd76ba0004e"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/c73a58661a760373d08a6883af4f0bb5cc991a67"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}],"remediation":[],"revision":"ec8cb7cab76a2b56d1abcd88ee1ac103d8344e29b2d893cb36d1de8aad5d1b88","sources":[{"modifiedAt":1793915101645,"name":"CNA: Linux","retrievedAt":1793917061388,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31487"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917074055,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31487"}],"ssvc":{"assessedAt":1793914497394,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"spi: use generic driver_override infrastructure","updatedAt":1793917074055}