CVE-2026-68467 mtd: mchp23k256: use SPI match data for chip caps
Incorrect MTD geometry selection for non-OF SPI matches in the mchp23k256 driver could lead to functional errors or data corruption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68467?
CVE-2026-68467 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mtd: mchp23k256: use SPI match data for chip caps
The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses of_device_get_match_data(), so a non-OF SPI modalias match falls back to mchp23k256_caps even when the SPI id table selected a different part.
Use spi_get_device_match_data() so SPI id-table driver_data is consumed when OF match data is absent. This keeps the existing default fallback while avoiding the wrong MTD geometry for id-table-only matches.
Which versions are affected by CVE-2026-68467?
How do I fix CVE-2026-68467?
Apply the vendor's patch.
Is CVE-2026-68467 being exploited?
There is no known exploitation of CVE-2026-68467 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68467, DEBIAN-CVE-2026-68467, GHSA-p34j-xw9f-x58x, UBUNTU-CVE-2026-68467.