CVE-2026-98931 (GCVE-0-2026-98931)
Vulnerability from cvelistv5
Published
2026-10-23 12:11
Modified
2026-10-30 12:40
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddev_get_ecc_engine() takes the NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving nand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it unconditionally to test for a pipelined engine, so probing such a device oopses immediately. Rather than open-coding the test three times, add a nand_ecc_is_pipelined() helper to the NAND core that folds the NULL check into the integration comparison, and use it everywhere. Future callers then cannot reintroduce the problem.
References
Impacted products
Vendor Product Version
Linux Linux Version: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2
Version: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2
Version: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2
Version: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2
Version: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2
Version: f9d7c7265bcff7d9a17425a8cddf702e8fe159c2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/nand/ecc.c",
            "drivers/mtd/nand/spi/core.c",
            "include/linux/mtd/nand.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ab781c7840bb8a210156e25eb0c027d6097fb74d",
              "status": "affected",
              "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2",
              "versionType": "git"
            },
            {
              "lessThan": "77c449c9c946fc420008dc55cd30f53749c915e4",
              "status": "affected",
              "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2",
              "versionType": "git"
            },
            {
              "lessThan": "3c765fd5212c1bbc71568b1518a7ec963a7040b4",
              "status": "affected",
              "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2",
              "versionType": "git"
            },
            {
              "lessThan": "80e8b0ea73ba295e92dfb6cf1c41df9da64234c6",
              "status": "affected",
              "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2",
              "versionType": "git"
            },
            {
              "lessThan": "fc2f651f520394893b14b75281a01e502bfa73bb",
              "status": "affected",
              "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2",
              "versionType": "git"
            },
            {
              "lessThan": "b890e6163761ddb580cc74f43e15f8bbde15647e",
              "status": "affected",
              "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/nand/ecc.c",
            "drivers/mtd/nand/spi/core.c",
            "include/linux/mtd/nand.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spinand: fix NULL pointer dereference with no ECC engine\n\nWhen \"nand-no-ecc-engine\" is set in DT, nanddev_get_ecc_engine() takes\nthe NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving\nnand-\u003eecc.engine NULL. The SPI-NAND code nevertheless dereferences it\nunconditionally to test for a pipelined engine, so probing such a\ndevice oopses immediately.\n\nRather than open-coding the test three times, add a\nnand_ecc_is_pipelined() helper to the NAND core that folds the NULL\ncheck into the integration comparison, and use it everywhere. Future\ncallers then cannot reintroduce the problem."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:40:20.679Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ab781c7840bb8a210156e25eb0c027d6097fb74d"
        },
        {
          "url": "https://git.kernel.org/stable/c/77c449c9c946fc420008dc55cd30f53749c915e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c765fd5212c1bbc71568b1518a7ec963a7040b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/80e8b0ea73ba295e92dfb6cf1c41df9da64234c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc2f651f520394893b14b75281a01e502bfa73bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b890e6163761ddb580cc74f43e15f8bbde15647e"
        }
      ],
      "title": "mtd: spinand: fix NULL pointer dereference with no ECC engine",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98931",
    "datePublished": "2026-10-23T12:11:34.935Z",
    "dateReserved": "2026-09-25T10:25:14.381Z",
    "dateUpdated": "2026-10-30T12:40:20.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.