Medium 5.5Published Jul 19, 2026

CVE-2026-63861spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback

Updated under an hour ago (Oct 28, 2026, 2:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	764f1b7481645b2b4488eda26c4da7f331697e6b builds before 6aea4a99410615912d80a4ba0827c4e8d4a8312d; 764f1b7481645b2b4488eda26c4da7f331697e6b builds before 3e79a563377a319d016ed0d3cd8c43171670c0f3; from 764f1b7481645b2b4488eda26c4da7f331697e6b before 86357e1d0157d8408b78f8768a69ab263d010316; from 764f1b7481645b2b4488eda26c4da7f331697e6b before e0b049bd7b279d7b6ad22a637cddced93198a51b; 764f1b7481645b2b4488eda26c4da7f331697e6b builds before 98cf4b58299e0c6a537c68cd32155d9e7569e7cb; from 764f1b7481645b2b4488eda26c4da7f331697e6b before ab00febad191d7a4400aa1c3468279fb508258d4	CNA record
linux linux_kernel linux:linux_kernel	from 5.19 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/6aea4a99410615912d80a4ba0827c4e8d4a8312d	patch
https://git.kernel.org/stable/c/3e79a563377a319d016ed0d3cd8c43171670c0f3	patch
https://git.kernel.org/stable/c/86357e1d0157d8408b78f8768a69ab263d010316	patch
https://git.kernel.org/stable/c/e0b049bd7b279d7b6ad22a637cddced93198a51b	patch
https://git.kernel.org/stable/c/98cf4b58299e0c6a537c68cd32155d9e7569e7cb	patch
https://git.kernel.org/stable/c/ab00febad191d7a4400aa1c3468279fb508258d4	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.