CVE-2026-31783
SPI ECC Engine Unregistration Flaw in Amlogic SPIFC-A4
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| amlogic | spifc-a4 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability involves missing teardown of the NAND ECC engine registration in the Linux kernel's amlogic spifc-a4 driver. To mitigate this, ensure your system is updated with the Linux kernel version that includes the fix where devm cleanup actions are added to automatically unregister the ECC engine on probe failures and device removal.
This means applying the latest kernel patches or updates that address this issue will prevent potential resource leaks or instability related to the ECC engine.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's amlogic spifc-a4 driver related to the NAND ECC engine registration process. Specifically, the aml_sfc_probe() function registers the on-host NAND ECC engine but lacks proper teardown procedures during probe failure or device removal. This means that if the probe fails or the device is removed, the ECC engine is not unregistered correctly, potentially leading to resource leaks or inconsistent states. The fix involves adding a cleanup action to automatically unregister the ECC engine on probe failures and during device removal.
How can this vulnerability impact me? :
The impact of this vulnerability could include resource leaks or improper cleanup of the NAND ECC engine in the Linux kernel. This might lead to system instability, unexpected behavior, or degraded performance related to NAND flash memory operations. However, no specific CVSS score or detailed impact assessment is provided.