{"id":"AZL-110714","summary":"CVE-2026-98931 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spinand: fix NULL pointer dereference with no ECC engine\n\nWhen \"nand-no-ecc-engine\" is set in DT, nanddev_get_ecc_engine() takes\nthe NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving\nnand-\u003eecc.engine NULL. The SPI-NAND code nevertheless dereferences it\nunconditionally to test for a pipelined engine, so probing such a\ndevice oopses immediately.\n\nRather than open-coding the test three times, add a\nnand_ecc_is_pipelined() helper to the NAND core that folds the NULL\ncheck into the integration comparison, and use it everywhere. Future\ncallers then cannot reintroduce the problem.","modified":"2026-10-30T05:35:37Z","published":"2026-10-23T13:17:13Z","upstream":["CVE-2026-98931"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98931"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110714.json"}}],"schema_version":"1.9.2"}