CVE-2026-46261

What it actually does

This is a local denial-of-service flaw in the Linux kernel WPCM FIU SPI controller driver. During driver probing, the code can call resource_size() on a NULL resource pointer if platform_get_resource_byname() fails to find the expected memory resource. On affected systems where the wpcm-fiu driver is present and probeable, a malformed or missing platform resource can trigger a kernel NULL pointer dereference, causing a kernel oops or panic and loss of system availability. The vulnerability does not directly provide confidentiality or integrity impact and is not known to enable code execution.

Why it matters to the business

Successful exploitation can crash affected Linux systems, interrupting services hosted on those systems and potentially causing unplanned downtime, watchdog-triggered reboots, or operational instability. Risk is highest for embedded, BMC, appliance, or hardware-management platforms using the Nuvoton WPCM FIU SPI controller driver. The CVSS score is moderate, EPSS is very low, it is not listed in CISA KEV, and there is no public exploit maturity reported, so this should be prioritized based on whether the affected driver and hardware are present in production-critical systems.

How an attack unfolds

An attacker first needs local access to a system where the affected Linux kernel driver is available and where they can cause or influence probing of the wpcm-fiu platform driver with an incomplete or malformed resource definition. When the driver probe path runs, it requests a named platform memory resource. If that resource lookup returns NULL and the vulnerable code attempts to calculate its size before validating the mapping result, the kernel dereferences the NULL pointer. The result is typically a kernel oops or panic rather than attacker-controlled execution. In realistic deployments, exploitation is most plausible where local users can trigger driver binding, load kernel modules, apply device-tree overlays, manipulate platform-device definitions, or otherwise influence hardware enumeration.

How to fix it

Upgrade to a Linux kernel or vendor-maintained kernel package that includes the upstream fix for the wpcm-fiu probe NULL pointer dereference in the SPI subsystem. Because no exact fixed versions were provided, use the latest security-supported kernel from the operating system, appliance, or hardware vendor and confirm that the patch moving the fiu->memory_size assignment after successful resource validation is included. If immediate patching is not possible, mitigate by disabling, unloading, or blacklisting the wpcm-fiu driver where it is not required; restricting kernel module loading to trusted administrators; preventing untrusted device-tree overlays or platform-device manipulation; and limiting local shell access on systems where this driver is present. For production embedded or BMC platforms, obtain firmware or board-support-package updates from the vendor.

How to confirm the fix worked

Confirm exposure by checking whether the running kernel contains the wpcm-fiu driver and whether the platform uses the affected SPI controller. Review kernel configuration, loaded modules, sysfs driver bindings, and vendor kernel changelogs. Validate remediation by booting the updated kernel, confirming the patched kernel package or firmware version is active, and verifying there are no kernel oops or probe failures referencing wpcm-fiu during boot or device enumeration. Where safe in a test environment, attempt to reproduce the prior malformed-resource probe condition and confirm the driver now fails cleanly instead of dereferencing NULL.

Typical attack path

1. Obtain local access to an affected Linux system.
2. Determine whether the wpcm-fiu SPI controller driver is present, loadable, or bound to hardware.
3. Trigger or influence the driver probe path with the expected named memory resource absent or malformed.
4. Cause platform_get_resource_byname() to return NULL during probe.
5. Reach the vulnerable resource_size() call on the NULL resource pointer.
6. Crash the kernel or trigger a kernel oops, causing denial of service or reboot.

How to detect it

Look for evidence of kernel crashes or probe-time failures involving the wpcm-fiu SPI driver. Relevant log sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, serial console logs, crash dumps, kdump/vmcore artifacts, and appliance or BMC event logs. Search for NULL pointer dereference, kernel oops, panic, call traces, and driver probe messages occurring near wpcm-fiu, SPI, resource_size, platform_get_resource_byname, or devm_ioremap_resource references. Correlate crashes with local administrative activity such as module loading, driver unbinding/binding, firmware updates, device-tree overlay changes, or hardware enumeration events. Because this issue causes availability impact and does not create a stable file, process, account, or network artifact, detection is primarily crash-log and forensic-timeline based.

• wpcm-fiu
• spi: wpcm-fiu
• NULL pointer dereference
• BUG: kernel NULL pointer dereference
• Oops:
• Kernel panic
• resource_size
• platform_get_resource_byname
• devm_ioremap_resource
• wpcm_fiu_probe
• /var/log/kern.log
• /var/log/messages
• journalctl -k
• /proc/vmcore

What your security team should do

• Inventory Linux, embedded, BMC, and appliance systems for kernels that include the wpcm-fiu SPI controller driver.
• Prioritize patching systems where the affected driver is present on production-critical hardware or where local users can influence driver binding or device configuration.
• Upgrade to the latest vendor-supported kernel or firmware that includes the upstream wpcm-fiu probe fix.
• If the driver is not needed, disable or blacklist it and verify it is not loaded at boot.
• Restrict kernel module loading, device-tree overlay application, and platform-device manipulation to trusted administrators only.
• Monitor kernel logs for NULL pointer dereferences, oops, panic events, and probe failures involving wpcm-fiu.
• Treat unexpected crashes on affected embedded or management platforms as potential denial-of-service attempts until logs are reviewed.