CVE-2026-63861 Overview
CVE-2026-63861 is a Linux kernel vulnerability in the MediaTek Serial NAND Flash Interface (SNFI) SPI driver (spi-mtk-snfi). The mtk_snand_probe() function registers the on-host NAND Error Correction Code (ECC) engine, but the driver omits corresponding teardown logic in both the probe error path and the remove() callback. When probe fails or the device is removed, nand_ecc_unregister_on_host_hw_engine() is never invoked, leaving stale ECC engine registrations bound to freed driver state.
Critical Impact
Missing cleanup of the NAND ECC engine on spi-mtk-snfi probe failure or device removal can leave dangling kernel references, creating conditions for use-after-free access and kernel instability on affected MediaTek platforms.
Affected Products
- Linux kernel builds enabling the spi-mtk-snfi driver (MediaTek SoCs with on-host NAND ECC)
- Stable branches referenced by the fix commits 3e79a56, 6aea4a9, 86357e1, 98cf4b5, ab00feb, and e0b049b
- Downstream distributions and embedded firmware images shipping the vulnerable driver
Discovery Timeline
- 2026-07-19 - CVE-2026-63861 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63861
Vulnerability Analysis
The defect lies in the lifecycle management of the MediaTek SPI-NAND driver. During probe, mtk_snand_probe() calls the NAND core to register the on-host hardware ECC engine. This registration is expected to be paired with nand_ecc_unregister_on_host_hw_engine() when the driver unwinds after an error or when the device is removed.
Because neither the probe error path nor the remove() callback issued the unregister call, the ECC engine remained linked in the NAND core lists after the underlying driver context was released. Subsequent NAND core lookups could dereference freed structures, and reprobe attempts could re-register an already registered engine.
The fix replaces manual bookkeeping with a devm_add_action_or_reset() cleanup action installed immediately after successful registration. The device-managed callback runs automatically on probe failure and during device teardown, guaranteeing the ECC engine is unregistered in every unwind path.
Root Cause
The root cause is missing resource cleanup on error and removal paths in drivers/spi/spi-mtk-snfi.c. Registration of a kernel-wide resource without a matching deregistration is a classic driver lifecycle bug that maps to CWE-772 (Missing Release of Resource after Effective Lifetime).
Attack Vector
Triggering the flaw requires local interaction with the driver lifecycle on affected MediaTek hardware. A privileged user or automated hotplug event can force repeated probe or bind/unbind cycles, exercising the missing teardown path. Remote exploitation is not applicable because the driver is not exposed over any network interface. The primary risk is kernel memory corruption and system instability rather than remote compromise.
No public exploit is available, and the EPSS probability is 0.161%. See the upstream fixes for technical details: Kernel Git Commit 3e79a56 and Kernel Git Commit 86357e1.
Detection Methods for CVE-2026-63861
Indicators of Compromise
- Kernel log messages referencing mtk_snand, spi-mtk-snfi, or NAND ECC engine registration failures during boot or module reload
- Repeated probe/remove cycles for the SPI-NAND controller followed by kernel warnings, BUG: traces, or KASAN reports involving nand_ecc_* symbols
- Unexpected kernel panics on MediaTek platforms during driver unbind or firmware upgrade operations
Detection Strategies
- Inventory Linux hosts and embedded devices running MediaTek SoCs with the spi-mtk-snfi driver compiled or loaded
- Compare running kernel versions against the fixed stable branches identified by commits 3e79a56, 6aea4a9, 86357e1, 98cf4b5, ab00feb, and e0b049b
- Enable KASAN and lockdep in test builds to surface use-after-free or reference-count issues during driver bind/unbind stress tests
Monitoring Recommendations
- Forward dmesg and journalctl -k output to a centralized log platform and alert on NAND ECC or SPI-NAND driver errors
- Monitor kernel crash telemetry (kdump, pstore) on MediaTek fleets for panics correlating with device removal events
- Track patch deployment status of the Linux kernel across embedded and IoT assets using configuration management inventories
How to Mitigate CVE-2026-63861
Immediate Actions Required
- Update affected systems to a Linux kernel version that includes the referenced stable fix commits
- Restrict physical and administrative access that can trigger driver bind/unbind or hotplug events on MediaTek NAND devices
- Validate vendor firmware images for embedded MediaTek platforms and request patched builds where necessary
Patch Information
The upstream fix adds a devm cleanup action after successful ECC engine registration, ensuring nand_ecc_unregister_on_host_hw_engine() runs on every probe failure and remove path. Apply the changes from any of the following backports: Kernel Git Commit 3e79a56, Kernel Git Commit 6aea4a9, Kernel Git Commit 86357e1, Kernel Git Commit 98cf4b5, Kernel Git Commit ab00feb, and Kernel Git Commit e0b049b.
Workarounds
- Blacklist or unload the spi-mtk-snfi module on systems that do not require NAND flash support until the patched kernel is deployed
- Avoid manual bind/unbind cycles of the SPI-NAND controller in production until the fix is applied
- Where hardware permits, disable on-host NAND ECC engine registration by using an alternative NAND controller configuration until patched firmware is available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
