CVE-2026-31389

CVE-2026-31389 addresses a use-after-free vulnerability in the Linux kernel's Serial Peripheral Interface (SPI) subsystem. This flaw occurs during controller registration if per-cpu statistics allocation fails, potentially leading to improper resource handling and unclocked register accesses. While specific attack vectors are not detailed, this issue could result in system instability or denial of service due to the use-after-free condition. Its low FAUCET Risk Score of 20.0/100 and extremely low EPSS score suggest a limited practical impact and exploitability. There is no evidence of active exploitation, nor is public exploit code available on platforms like Metasploit or ExploitDB, with community discussion and media coverage being minimal.