CVE-2026-31783
Analyzed Analyzed - Analysis Complete
SPI ECC Engine Unregistration Flaw in Amlogic SPIFC-A4

Publication date: 2026-05-01

Last updated on: 2026-05-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-11
Generated
2026-06-16
AI Q&A
2026-05-01
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31783
EUVD
EUVD-2026-26596
Affected Vendors & Products
Showing 9 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.18
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.19 (inc) to 6.19.12 (exc)
linux linux_kernel From 6.18.1 (inc) to 6.18.22 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's amlogic spifc-a4 driver related to the NAND ECC engine registration process. Specifically, the aml_sfc_probe() function registers the on-host NAND ECC engine but lacks proper teardown procedures during probe failure or device removal. This means that if the probe fails or the device is removed, the ECC engine is not unregistered correctly, potentially leading to resource leaks or inconsistent states. The fix involves adding a cleanup action to automatically unregister the ECC engine on probe failures and during device removal.

Impact Analysis

The impact of this vulnerability could include resource leaks or improper cleanup of the NAND ECC engine in the Linux kernel. This might lead to system instability, unexpected behavior, or degraded performance related to NAND flash memory operations. However, no specific CVSS score or detailed impact assessment is provided.

Mitigation Strategies

The vulnerability involves missing teardown of the NAND ECC engine registration in the Linux kernel's amlogic spifc-a4 driver. To mitigate this, ensure your system is updated with the Linux kernel version that includes the fix where devm cleanup actions are added to automatically unregister the ECC engine on probe failures and device removal.

This means applying the latest kernel patches or updates that address this issue will prevent potential resource leaks or instability related to the ECC engine.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31783. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart