CVE-2026-23434

Root

Cause In the Linux kernel's MTD raw NAND driver, the nand_lock() and nand_unlock() functions call chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, this can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, leading to cmd_pending conflicts on the NAND controller [1][2].

Exploitation

An attacker with local access to a system utilizing UBI/UBIFS on raw NAND could trigger this race condition by initiating lock/unlock operations concurrently with background erase/write operations. No special privileges are required beyond the ability to trigger NAND lock/unlock calls, which may be accessible through user-space MTD interfaces [3].

Impact

Successful exploitation can cause cmd_pending conflicts, potentially leading to data corruption or denial of service by stalling NAND operations. The vulnerability is rated High with a CVSS v3 score of 7.1, reflecting moderate impact on integrity and availability [4].

Mitigation

The fix adds nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access. Patches have been merged into the stable kernel trees as commits [1][2][3][4]. Users are advised to update to the latest stable kernel version that includes the fix.