CVE-2026-31783

The vulnerability resides in the Amlogic SPI flash controller (spifc-a4) driver within the Linux kernel. During probe (aml_sfc_probe()), the driver registers an on-host NAND ECC engine, and the fix addresses the absence of a corresponding teardown, ensuring nand_ecc_unregister_on_host_hw_engine() is called both on probe failures and during device removal.

Exploitation requires no special privileges; the bug manifests during normal driver loading or unloading sequences. An attacker would need the ability to repeatedly trigger driver probe failures (e.g., via hot-plugging/unplugging or fw-loading) to accumulate leaked resources, potentially degrading system stability.

The impact is primarily resource exhaustion leading to denial of service (CVSS 5.5). An unprivileged local user could cause a system hang by exhausting kernel memory, though there is no evidence of data corruption or privilege escalation.

A patch has been merged into the Linux kernel stable tree (commits tracked in [1][2][3]). Systems running affected kernel versions should apply the update. No workaround exists other than updating the kernel.