CVE-2026-23434: mtd: rawnand: serialize lock/unlock against other NAND operations
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: serialize lock/unlock against other NAND operations
nandlock() and nandunlock() call into chip->ops.lockarea/unlockarea without holding the NAND device lock. On controllers that implement SETFEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmdpending conflicts on the NAND controller.
Add nandgetdevice()/nandreleasedevice() around the lock/unlock operations to serialize them against all other NAND controller access.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23434?
The severity of CVE-2026-23434 is high with a score of 7.1.
How do I fix CVE-2026-23434?
To fix CVE-2026-23434, you should update the Linux kernel to the latest patched version that addresses this vulnerability.
What impact does CVE-2026-23434 have on Linux systems?
CVE-2026-23434 can lead to potential data corruption or denial of service on systems using vulnerable NAND flash devices.
Which versions of the Linux kernel are affected by CVE-2026-23434?
CVE-2026-23434 affects specific versions of the Linux kernel prior to the release of the patch that addresses this vulnerability.
Is CVE-2026-23434 exploitable remotely?
CVE-2026-23434 has a low attack vector rating, making remote exploitation less likely but still possible under certain conditions.