Linux Kernel CVE-2026-68467

The mchp23k256 driver manages the Microchip 23K256/23LC1024 family of SPI-attached SRAM chips under the Linux kernel's Memory Technology Device (MTD) subsystem. Linux supports two parallel device-matching paths at probe time: Open Firmware/Device Tree (OF) and the SPI id-table. The driver previously used of_device_get_match_data(), which returns NULL when the match path was SPI id-table only (no DT node), causing the code to silently fall back to the compile-time default mchp23k256_caps even when the SPI id-table driver_data pointed to a different chip variant with a different capacity. The fix replaces this call with spi_get_device_match_data(), which checks both paths and returns the correct driver_data regardless of how the device was matched. The root cause is a missing multi-path match abstraction rather than a traditional CWE-classified memory safety error - no CWE is assigned. Affected kernel versions trace back to commit 4379075a870b (Linux 4.13, when the driver was introduced).