CVE-2026-31783: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31783 is a Linux kernel vulnerability in the Amlogic SPI flash controller driver (spi: amlogic: spifc-a4) caused by incomplete cleanup of the on-host NAND ECC engine during probe failure and device removal. The aml_sfc_probe() function registers the ECC engine but lacks corresponding teardown code in both the probe error path and the remove() callback, leaving resources improperly allocated. Affected kernel versions include 6.18.1–6.18.21, 6.19.0–6.19.11, and 7.0-rc1 through rc6. It was published on May 1, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-459 (Incomplete Cleanup): the aml_sfc_probe() function in the Amlogic SPI flash controller driver registers an on-host NAND ECC engine via nand_ecc_register_on_host_hw_engine(), but the corresponding nand_ecc_unregister_on_host_hw_engine() call is absent from both the probe failure unwind path and the remove() callback (GitHub Advisory). The fix adds a devm cleanup action immediately after successful ECC engine registration, ensuring automatic teardown on probe failure or device removal. Exploitation requires local access with low privileges (e.g., ability to trigger device removal or cause a probe failure on an affected system) (Red Hat Bugzilla).

Successful exploitation can cause a kernel crash (denial of service) due to improper resource cleanup when the ECC engine is left registered without being properly torn down. A local user with sufficient privileges to trigger device removal or probe failure can induce this condition, resulting in system unavailability. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to local attackers with low privileges on systems running affected kernel versions with Amlogic SPI flash hardware.

Patches are available in Linux kernel stable branches 6.18.22+, 6.19.12+, and 7.0 (rc7 or final release). The fix introduces a devm cleanup action after successful ECC engine registration so that nand_ecc_unregister_on_host_hw_engine() is called automatically on probe failure or device removal (GitHub Advisory). Administrators should update to a patched kernel version as the primary remediation. As a secondary measure, restricting local administrative access to limit the ability to trigger device removal operations can reduce exposure on systems that cannot be immediately patched (Red Hat Bugzilla).