CVE-2026-63861
Published Jul 19, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal.
Is your site exposed to CVE-2026-63861?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
0.0016
Probability of exploitation
0.06%
Percentile rank
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
References
Other References
https://git.kernel.org/stable/c/3e79a563377a319d016ed0d3cd8c43171670c0f3
https://git.kernel.org/stable/c/6aea4a99410615912d80a4ba0827c4e8d4a8312d
https://git.kernel.org/stable/c/86357e1d0157d8408b78f8768a69ab263d010316
https://git.kernel.org/stable/c/98cf4b58299e0c6a537c68cd32155d9e7569e7cb
https://git.kernel.org/stable/c/ab00febad191d7a4400aa1c3468279fb508258d4
https://git.kernel.org/stable/c/e0b049bd7b279d7b6ad22a637cddced93198a51b
Frequently Asked Questions
What is CVE-2026-63861? +
In the Linux kernel, the following vulnerability has been resolved:
spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was
missing from both probe unwind and remove-time cleanup. Add a devm cleanup
action after successful registration so
nand_ecc_unregister_on_host_hw_engine() runs automatically on probe
failures and during device removal.
How do I check if I'm vulnerable to CVE-2026-63861? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.