All vulnerabilities
CVE-2026-98931

Linux: mtd: spinand: fix NULL pointer dereference with no ECC engine

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in77c449c9c946fc420008dc55cd30f53749c915e4Also 3c765fd5212c1bbc71568b1518a7ec963a7040b4, 80e8b0ea73ba295e92dfb6cf1c41df9da64234c6CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 77c449c9c946fc420008dc55cd30f53749c915e4LinuxCVE List
  • 3c765fd5212c1bbc71568b1518a7ec963a7040b4LinuxCVE List
  • 80e8b0ea73ba295e92dfb6cf1c41df9da64234c6LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: spinand: fix NULL pointer dereference with no ECC engine

When "nand-no-ecc-engine" is set in DT, nanddev_get_ecc_engine() takes the NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving nand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it unconditionally to test for a pipelined engine, so probing such a device oopses immediately.

Rather than open-coding the test three times, add a nand_ecc_is_pipelined() helper to the NAND core that folds the NULL check into the integration comparison, and use it everywhere. Future callers then cannot reintroduce the problem.

Text from CVE List

Affected versions 12

  • Linuxaffected: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 before 77c449c9c946fc420008dc55cd30f53749c915e4CVE List
  • Linuxaffected: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 before 3c765fd5212c1bbc71568b1518a7ec963a7040b4CVE List
  • Linuxaffected: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 before 80e8b0ea73ba295e92dfb6cf1c41df9da64234c6CVE List
  • Linuxaffected: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 before fc2f651f520394893b14b75281a01e502bfa73bbCVE List
  • Linuxaffected: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 before b890e6163761ddb580cc74f43e15f8bbde15647eCVE List
  • Linuxaffected: 5.18CVE List
  • Linuxunaffected: all versions before 5.18CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5