CVE-2026-23434

mtd: rawnand: serialize lock/unlock against other NAND operations

State: Published
Severity: 7.1 High
Published: Apr 3, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: serialize lock/unlock against other NAND operations

nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller.

Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	92270086b7e5ada7ab381c06cc3da2e95ed17088 to before 28ea836cc44cb8b89c1c174707ead0c1133c60e9Affected 92270086b7e5ada7ab381c06cc3da2e95ed17088 to before fe4a73c3dd48308149d57a10c2761e1d36ced7baAffected 92270086b7e5ada7ab381c06cc3da2e95ed17088 to before ce5229e78078e437704157eb542f43a6f83b429bAffected 92270086b7e5ada7ab381c06cc3da2e95ed17088 to before a80291e577b44593a724d6cd64c14337c78f194dAffected 92270086b7e5ada7ab381c06cc3da2e95ed17088 to before f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2Affected 92270086b7e5ada7ab381c06cc3da2e95ed17088 to before 5fd5c078af23cb353507aa522e09d557d7eaef04Affected 92270086b7e5ada7ab381c06cc3da2e95ed17088 to before f25446e2c28939753d3b62d34dfda49952b2557dAffected 92270086b7e5ada7ab381c06cc3da2e95ed17088 to before bab2bc6e850a697a23b9e5f0e21bb8c187615e95Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.20 through 6.18.Not affected 6.19.10 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

92270086b7e5ada7ab381c06cc3da2e95ed17088 to before 28ea836cc44cb8b89c1c174707ead0c1133c60e9Affected
92270086b7e5ada7ab381c06cc3da2e95ed17088 to before fe4a73c3dd48308149d57a10c2761e1d36ced7baAffected
92270086b7e5ada7ab381c06cc3da2e95ed17088 to before ce5229e78078e437704157eb542f43a6f83b429bAffected
92270086b7e5ada7ab381c06cc3da2e95ed17088 to before a80291e577b44593a724d6cd64c14337c78f194dAffected
92270086b7e5ada7ab381c06cc3da2e95ed17088 to before f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2Affected
92270086b7e5ada7ab381c06cc3da2e95ed17088 to before 5fd5c078af23cb353507aa522e09d557d7eaef04Affected
92270086b7e5ada7ab381c06cc3da2e95ed17088 to before f25446e2c28939753d3b62d34dfda49952b2557dAffected
92270086b7e5ada7ab381c06cc3da2e95ed17088 to before bab2bc6e850a697a23b9e5f0e21bb8c187615e95Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.20 through 6.18.*Not affected
6.19.10 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.