CVE-2026-98931: mtd: spinand: fix NULL pointer dereference with no ECC engine
Noroxi assessment
Priority: Monitor (action score 0/100)
- The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.17% (FIRST EPSS).
- Fixed version: Linux Linux 3c765fd5212c1bbc71568b1518a7ec963a7040b4, 77c449c9c946fc420008dc55cd30f53749c915e4, 80e8b0ea73ba295e92dfb6cf1c41df9da64234c6; azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Release Notes; azl3 kernel 6.6.159.1-1 on Azure Linux 3.0 6.6.161.1-1.
- Mentioned 1 time in Turkish national cyber security advisories (siberguvenlik.gov.tr).
Low priority for now. Upgrade to Linux Linux 3c765fd5212c1bbc71568b1518a7ec963a7040b4, 77c449c9c946fc420008dc55cd30f53749c915e4, 80e8b0ea73ba295e92dfb6cf1c41df9da64234c6; azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Release Notes; azl3 kernel 6.6.159.1-1 on Azure Linux 3.0 6.6.161.1-1 or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddev_get_ecc_engine() takes the NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving nand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it unconditionally to test for a pipelined engine, so probing such a device oopses immediately. Rather than open-coding the test three times, add a nand_ecc_is_pipelined() helper to the NAND core that folds the NULL check into the integration comparison, and use it everywhere. Future callers then cannot reintroduce the problem.
- Published
- Oct 23, 2026
- Updated
- Oct 30, 2026
- EPSS
- 0.1% · 6th percentile
- CWE
- —
Report tools
Action score
0
Low priority for now.
- CVSS
- 0 / 40 · —
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.1%
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- No public exploit code on record
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Is your version affected? Check itNoroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
—
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 5.18affected
- f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 and later · before ab781c7840bb8a210156e25eb0c027d6097fb74daffected · git
- f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 and later · before 77c449c9c946fc420008dc55cd30f53749c915e4affected · git
- f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 and later · before 3c765fd5212c1bbc71568b1518a7ec963a7040b4affected · git
- f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 and later · before 80e8b0ea73ba295e92dfb6cf1c41df9da64234c6affected · git
- f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 and later · before fc2f651f520394893b14b75281a01e502bfa73bbaffected · git
- f9d7c7265bcff7d9a17425a8cddf702e8fe159c2 and later · before b890e6163761ddb580cc74f43e15f8bbde15647eaffected · git
- before 5.18not affected · semver
- 6.1.191 and later · up to and including 6.1.*not affected · semver
- 6.6.160 and later · up to and including 6.6.*not affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| Debian:12 | linux | from 0 | — |
| Debian:13 | linux | before 6.12.113-1 | 6.12.113-1 |
| Debian:14 | linux | before 7.2.10-1 | 7.2.10-1 |
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation40Plan
- CVE-2026-74612veth: fix skb length accounting after XDP frag adjustment40Plan
- CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()40Plan
Published before and after this one in the same product
- ← EarlierCVE-2026-98929Oct 23, 2026 · macsec: initialize SecY before registering the netdevice0Monitor
- ← EarlierCVE-2026-98930Oct 23, 2026 · KVM: s390: Fix IRQ injection with SIGP Stop and Store Status0Monitor
- Later →CVE-2026-98932Oct 23, 2026 · EDAC/altera: Fix use-after-free in error paths29Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 3c765fd5212c1bbc71568b1518a7ec963a7040b4 | Vendor (CNA) |
| Linux Linux | 77c449c9c946fc420008dc55cd30f53749c915e4 | Vendor (CNA) |
| Linux Linux | 80e8b0ea73ba295e92dfb6cf1c41df9da64234c6 | Vendor (CNA) |
| Linux Linux | ab781c7840bb8a210156e25eb0c027d6097fb74d | Vendor (CNA) |
| Linux Linux | b890e6163761ddb580cc74f43e15f8bbde15647e | Vendor (CNA) |
| Linux Linux | fc2f651f520394893b14b75281a01e502bfa73bb | Vendor (CNA) |
| azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 | Release Notes | Microsoft (MSRC) |
| azl3 kernel 6.6.159.1-1 on Azure Linux 3.0 | 6.6.161.1-1 · Release Notes | Microsoft (MSRC) |
| debian:linux | 6.12.113-1 · Debian:13 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
- Published
- Fix recordedsame day
- TodayNov 13, 2026+21 d
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
National notice (Türkiye Cybersecurity Directorate / USOM)
Official security notices citing this record; remediation advice is on the agency's page.
- TR-26-1390 · Oct 26, 2026(Linux Kernel Güvenlik Bildirimi)
Not on record for this CVE: patch commit or PR link · researcher credit · variant or chain candidate · public bounty program.
Technical details
No CVSS vector for this record, so attack conditions can't be derived.
Weakness class (CWE)
—
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Change log (2)
- Exploit maturity— → none
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (5 more)Show less
- git.kernel.org/stable/c/77c449c9c946fc420008dc55cd30f53749c915e4
- git.kernel.org/stable/c/80e8b0ea73ba295e92dfb6cf1c41df9da64234c6
- git.kernel.org/stable/c/ab781c7840bb8a210156e25eb0c027d6097fb74d
- git.kernel.org/stable/c/b890e6163761ddb580cc74f43e15f8bbde15647e
- git.kernel.org/stable/c/fc2f651f520394893b14b75281a01e502bfa73bb
Vendor advisories and official records. Exploit/PoC links are deliberately left out.