Linux Kernel EUVD-2026-26596

The affected component is drivers/spi/spi-amlogic-spifc-a4.c, the SPI Flash Controller driver for Amlogic A4 series SoCs (System-on-Chip), commonly found in embedded Linux deployments. The bug is a missing resource deregistration: the kernel's NAND ECC subsystem requires symmetric register/unregister calls for on-host hardware ECC engines. When aml_sfc_probe() registers the engine via nand_ecc_register_on_host_hw_engine() but then encounters a probe error, or when the module is unloaded via remove(), the engine remains registered with stale or freed backing memory. While no CWE is formally assigned, this is canonically CWE-772 (Missing Release of Resource after Effective Lifetime). The fix, as indicated by the referenced stable commits, introduces a devm-managed cleanup action so teardown is handled automatically. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms the Linux kernel as the affected software package. Notably, the 'Information Disclosure' tag from metadata conflicts with the CVSS vector's C:N rating - this tag appears erroneous for this vulnerability class and should not be weighted.