CVE-2026-98931 - In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no
In the Linux kernel, the following vulnerability has been resolved:
mtd: spinand: fix NULL pointer dereference with no ECC engine
When "nand-no-ecc-engine" is set in DT, nanddev_get_ecc_engine() takes
the NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving
nand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it
unconditionally to test for a pipelined engine, so probing such a
device oopses immediately.
Rather than open-coding the test three times, add a
nand_ecc_is_pipelined() helper to the NAND core that folds the NULL
check into the integration comparison, and use it everywhere. Future
callers then cannot reintroduce the problem.
INFORMATIONAL
Severity & confidence
Source severityinformational
Platform severityinformational
Confidencehigh
Exploitationunknown
CVSS-
Affected
Vendorslinux
Reporting sources (1)
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-23T13:17:13
Last updated2026-10-26T06:14:42
Ingested2026-10-25T12:05:21
FreshnessNEAR-REAL-TIME
Threat typevulnerability
Recommended action
No recommended action published with this item - review the original source.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Source type: standards ยท Original: NIST NVD - National Vulnerability Database