CVE-2026-23434 PUBLISHED

mtd: rawnand: serialize lock/unlock against other NAND operations

Assigner: Linux
Reserved: 13.01.2026 Published: 03.04.2026 Updated: 03.04.2026

In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: serialize lock/unlock against other NAND operations

nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller.

Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 92270086b7e5ada7ab381c06cc3da2e95ed17088 to ce5229e78078e437704157eb542f43a6f83b429b (excl.)
  • affected from 92270086b7e5ada7ab381c06cc3da2e95ed17088 to a80291e577b44593a724d6cd64c14337c78f194d (excl.)
  • affected from 92270086b7e5ada7ab381c06cc3da2e95ed17088 to f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2 (excl.)
  • affected from 92270086b7e5ada7ab381c06cc3da2e95ed17088 to 5fd5c078af23cb353507aa522e09d557d7eaef04 (excl.)
  • affected from 92270086b7e5ada7ab381c06cc3da2e95ed17088 to f25446e2c28939753d3b62d34dfda49952b2557d (excl.)
  • affected from 92270086b7e5ada7ab381c06cc3da2e95ed17088 to bab2bc6e850a697a23b9e5f0e21bb8c187615e95 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.7 is affected
  • unaffected from 0 to 5.7 (excl.)
  • unaffected from 6.1.167 to 6.1.* (incl.)
  • unaffected from 6.6.130 to 6.6.* (incl.)
  • unaffected from 6.12.78 to 6.12.* (incl.)
  • unaffected from 6.18.20 to 6.18.* (incl.)
  • unaffected from 6.19.10 to 6.19.* (incl.)
  • unaffected from 7.0-rc5 to * (incl.)

References