CVE-2026-68467
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel's mchp23k256 driver for MTD, there is an issue with selecting chip capacity data: the driver uses of_device_get_match_data(), which when matched via SPI id table leads to using default data instead of the correct one. The fix changes to spi_get_device_match_data() to use SPI table data when OF data is absent.
Risk Assessment
Incorrect MTD geometry may lead to read/write errors on memory chips, potentially causing data corruption or system malfunction.
Recommendation
Apply the Linux kernel update containing the fix for CVE-2026-68467. Ensure systems using mchp23k256 chips have the updated kernel.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses of_device_get_match_data(), so a non-OF SPI modalias match falls back to mchp23k256_caps even when the SPI id table selected a different part. Use spi_get_device_match_data() so SPI id-table driver_data is consumed when OF match data is absent. This keeps the existing default fallback while avoiding the wrong MTD geometry for id-table-only matches.