Home

Description

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: serialize lock/unlock against other NAND operations nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller. Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access.

PUBLISHED Reserved 2026-01-13 | Published 2026-04-03 | Updated 2026-05-11 | Assigner Linux




HIGH: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Product status

Default status
unaffected

92270086b7e5ada7ab381c06cc3da2e95ed17088 (git) before 28ea836cc44cb8b89c1c174707ead0c1133c60e9
affected

92270086b7e5ada7ab381c06cc3da2e95ed17088 (git) before fe4a73c3dd48308149d57a10c2761e1d36ced7ba
affected

92270086b7e5ada7ab381c06cc3da2e95ed17088 (git) before ce5229e78078e437704157eb542f43a6f83b429b
affected

92270086b7e5ada7ab381c06cc3da2e95ed17088 (git) before a80291e577b44593a724d6cd64c14337c78f194d
affected

92270086b7e5ada7ab381c06cc3da2e95ed17088 (git) before f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2
affected

92270086b7e5ada7ab381c06cc3da2e95ed17088 (git) before 5fd5c078af23cb353507aa522e09d557d7eaef04
affected

92270086b7e5ada7ab381c06cc3da2e95ed17088 (git) before f25446e2c28939753d3b62d34dfda49952b2557d
affected

92270086b7e5ada7ab381c06cc3da2e95ed17088 (git) before bab2bc6e850a697a23b9e5f0e21bb8c187615e95
affected

Default status
affected

5.7
affected

Any version before 5.7
unaffected

5.10.253 (semver)
unaffected

5.15.203 (semver)
unaffected

6.1.167 (semver)
unaffected

6.6.130 (semver)
unaffected

6.12.78 (semver)
unaffected

6.18.20 (semver)
unaffected

6.19.10 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/28ea836cc44cb8b89c1c174707ead0c1133c60e9

git.kernel.org/...c/fe4a73c3dd48308149d57a10c2761e1d36ced7ba

git.kernel.org/...c/ce5229e78078e437704157eb542f43a6f83b429b

git.kernel.org/...c/a80291e577b44593a724d6cd64c14337c78f194d

git.kernel.org/...c/f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2

git.kernel.org/...c/5fd5c078af23cb353507aa522e09d557d7eaef04

git.kernel.org/...c/f25446e2c28939753d3b62d34dfda49952b2557d

git.kernel.org/...c/bab2bc6e850a697a23b9e5f0e21bb8c187615e95

cve.org (CVE-2026-23434)

nvd.nist.gov (CVE-2026-23434)

Download JSON