CVE-2026-31489

OVERVIEW CVE-2026-31489 is a double-put reference counting vulnerability in the Linux kernel's Meson SPICC (SPI Controller) driver. The flaw occurs in the device removal path where spi_controller_put() is called redundantly, as the controller reference is already released through devm cleanup handlers during devm_spi_register_controller() registration. SEVERITY This vulnerability carries a CVSS score that is not yet available, limiting definitive severity classification. The EPSS score of 0.00018 indicates minimal exploitability probability relative to other CVEs. As a reference counting error in kernel driver code, the potential impact could include denial of service through memory corruption or system crashes on systems utilizing the Meson SPICC driver, though the actual attack surface is narrow and requires local access to trigger the remove path. EXPLOITATION STATUS There is no evidence of active exploitation of this vulnerability. It has not been added to CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is available. The vulnerability appears to be a logic error discovered through code analysis rather than through field exploitation. Community attention remains minimal, as reflected by the low FAUCET risk score of 20.0/100.