CVE-2026-31783

Analyzed Analyzed - Analysis Complete

SPI ECC Engine Unregistration Flaw in Amlogic SPIFC-A4

Publication date: 2026-05-01

Last updated on: 2026-05-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-01

Last Modified

2026-05-11

Generated

2026-07-06

AI Q&A

2026-05-01

EPSS Evaluated

2026-07-05

NVD

CVE-2026-31783

EUVD

EUVD-2026-26596

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.18
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.19 (inc) to 6.19.12 (exc)
linux	linux_kernel	From 6.18.1 (inc) to 6.18.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's amlogic spifc-a4 driver related to the NAND ECC engine registration process. Specifically, the aml_sfc_probe() function registers the on-host NAND ECC engine but lacks proper teardown procedures during probe failure or device removal. This means that if the probe fails or the device is removed, the ECC engine is not unregistered correctly, potentially leading to resource leaks or inconsistent states. The fix involves adding a cleanup action to automatically unregister the ECC engine on probe failures and during device removal.

Impact Analysis

The impact of this vulnerability could include resource leaks or improper cleanup of the NAND ECC engine in the Linux kernel. This might lead to system instability, unexpected behavior, or degraded performance related to NAND flash memory operations. However, no specific CVSS score or detailed impact assessment is provided.

Mitigation Strategies

The vulnerability involves missing teardown of the NAND ECC engine registration in the Linux kernel's amlogic spifc-a4 driver. To mitigate this, ensure your system is updated with the Linux kernel version that includes the fix where devm cleanup actions are added to automatically unregister the ECC engine on probe failures and device removal.

This means applying the latest kernel patches or updates that address this issue will prevent potential resource leaks or instability related to the ECC engine.

Hi! I’m here to help you understand CVE-2026-31783. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70