CVE-2026-63861
Received Received - Intake

SPI NAND ECC Engine Unregistration Flaw in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63861
EUVD
EUVD-2026-45545

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's spi: mtk-snfi driver. It involves missing cleanup when the NAND ECC engine fails to register during probe or removal. The driver registers the engine but does not unregister it properly if probe fails or during device removal, potentially leaving the ECC engine registered incorrectly.

Detection Guidance

This vulnerability is specific to the Linux kernel's SPI MTK-SNFI driver and may not have direct network detection methods. Check kernel logs for errors related to NAND ECC engine registration or unregistration failures using dmesg | grep -i 'mtk_snand' or journalctl -k | grep -i 'mtk_snand'.

Impact Analysis

This could lead to system instability or resource leaks if the NAND ECC engine remains registered after probe failure or device removal. It may cause issues with NAND operations or memory management in affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a missing cleanup action in the Linux kernel's NAND ECC engine registration. No evidence suggests data exposure or privacy risks.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel logs for any related errors after updating. If you are using a custom kernel, ensure the mtk-snfi driver is patched to include proper ECC engine cleanup.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63861. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart