CVE-2026-98931

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98931", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.381Z", "datePublished": "2026-10-23T12:11:34.935Z", "dateUpdated": "2026-10-30T12:40:20.679Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:20.679Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spinand: fix NULL pointer dereference with no ECC engine\n\nWhen \"nand-no-ecc-engine\" is set in DT, nanddev_get_ecc_engine() takes\nthe NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving\nnand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it\nunconditionally to test for a pipelined engine, so probing such a\ndevice oopses immediately.\n\nRather than open-coding the test three times, add a\nnand_ecc_is_pipelined() helper to the NAND core that folds the NULL\ncheck into the integration comparison, and use it everywhere. Future\ncallers then cannot reintroduce the problem."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mtd/nand/ecc.c", "drivers/mtd/nand/spi/core.c", "include/linux/mtd/nand.h"], "versions": [{"version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "lessThan": "ab781c7840bb8a210156e25eb0c027d6097fb74d", "status": "affected", "versionType": "git"}, {"version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "lessThan": "77c449c9c946fc420008dc55cd30f53749c915e4", "status": "affected", "versionType": "git"}, {"version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "lessThan": "3c765fd5212c1bbc71568b1518a7ec963a7040b4", "status": "affected", "versionType": "git"}, {"version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "lessThan": "80e8b0ea73ba295e92dfb6cf1c41df9da64234c6", "status": "affected", "versionType": "git"}, {"version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "lessThan": "fc2f651f520394893b14b75281a01e502bfa73bb", "status": "affected", "versionType": "git"}, {"version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "lessThan": "b890e6163761ddb580cc74f43e15f8bbde15647e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mtd/nand/ecc.c", "drivers/mtd/nand/spi/core.c", "include/linux/mtd/nand.h"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ab781c7840bb8a210156e25eb0c027d6097fb74d"}, {"url": "https://git.kernel.org/stable/c/77c449c9c946fc420008dc55cd30f53749c915e4"}, {"url": "https://git.kernel.org/stable/c/3c765fd5212c1bbc71568b1518a7ec963a7040b4"}, {"url": "https://git.kernel.org/stable/c/80e8b0ea73ba295e92dfb6cf1c41df9da64234c6"}, {"url": "https://git.kernel.org/stable/c/fc2f651f520394893b14b75281a01e502bfa73bb"}, {"url": "https://git.kernel.org/stable/c/b890e6163761ddb580cc74f43e15f8bbde15647e"}], "title": "mtd: spinand: fix NULL pointer dereference with no ECC engine", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/mtd/nand/ecc.c", "drivers/mtd/nand/spi/core.c", "include/linux/mtd/nand.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ab781c7840bb8a210156e25eb0c027d6097fb74d", "status": "affected", "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "versionType": "git"}, {"lessThan": "77c449c9c946fc420008dc55cd30f53749c915e4", "status": "affected", "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "versionType": "git"}, {"lessThan": "3c765fd5212c1bbc71568b1518a7ec963a7040b4", "status": "affected", "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "versionType": "git"}, {"lessThan": "80e8b0ea73ba295e92dfb6cf1c41df9da64234c6", "status": "affected", "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "versionType": "git"}, {"lessThan": "fc2f651f520394893b14b75281a01e502bfa73bb", "status": "affected", "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "versionType": "git"}, {"lessThan": "b890e6163761ddb580cc74f43e15f8bbde15647e", "status": "affected", "version": "f9d7c7265bcff7d9a17425a8cddf702e8fe159c2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/mtd/nand/ecc.c", "drivers/mtd/nand/spi/core.c", "include/linux/mtd/nand.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spinand: fix NULL pointer dereference with no ECC engine\n\nWhen \"nand-no-ecc-engine\" is set in DT, nanddev_get_ecc_engine() takes\nthe NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving\nnand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it\nunconditionally to test for a pipelined engine, so probing such a\ndevice oopses immediately.\n\nRather than open-coding the test three times, add a\nnand_ecc_is_pipelined() helper to the NAND core that folds the NULL\ncheck into the integration comparison, and use it everywhere. Future\ncallers then cannot reintroduce the problem."}], "id": "CVE-2026-98931", "lastModified": "2026-10-30T13:21:31.610", "metrics": {}, "published": "2026-10-23T13:17:13.897", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c765fd5212c1bbc71568b1518a7ec963a7040b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/77c449c9c946fc420008dc55cd30f53749c915e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/80e8b0ea73ba295e92dfb6cf1c41df9da64234c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab781c7840bb8a210156e25eb0c027d6097fb74d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b890e6163761ddb580cc74f43e15f8bbde15647e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fc2f651f520394893b14b75281a01e502bfa73bb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mtd: spinand: fix NULL pointer dereference with no ECC engine", "id": "2559686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559686"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmtd: spinand: fix NULL pointer dereference with no ECC engine\nWhen \"nand-no-ecc-engine\" is set in DT, nanddev_get_ecc_engine() takes\nthe NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving\nnand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it\nunconditionally to test for a pipelined engine, so probing such a\ndevice oopses immediately.\nRather than open-coding the test three times, add a\nnand_ecc_is_pipelined() helper to the NAND core that folds the NULL\ncheck into the integration comparison, and use it everywhere. Future\ncallers then cannot reintroduce the problem.", "A flaw was found in the Linux kernel's Memory Technology Device (MTD) SPI-NAND driver. When probing a flash memory device configured without an Error Correction Code (ECC) engine, the driver attempts to access an uninitialized pointer. A local user could exploit this flaw to crash the system, resulting in a denial of service (DoS)."], "name": "CVE-2026-98931", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98931\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98931\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98931.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,77c449c9c946fc420008dc55cd30f53749c915e4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,3c765fd5212c1bbc71568b1518a7ec963a7040b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,80e8b0ea73ba295e92dfb6cf1c41df9da64234c6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,fc2f651f520394893b14b75281a01e502bfa73bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,b890e6163761ddb580cc74f43e15f8bbde15647e)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,77c449c9c946fc420008dc55cd30f53749c915e4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,3c765fd5212c1bbc71568b1518a7ec963a7040b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,80e8b0ea73ba295e92dfb6cf1c41df9da64234c6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,fc2f651f520394893b14b75281a01e502bfa73bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f9d7c7265bcff7d9a17425a8cddf702e8fe159c2,b890e6163761ddb580cc74f43e15f8bbde15647e)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T14:45:17.884696+00:00", "updated": "2026-10-29T14:00:17.125766+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}