CVE-2026-23434: mtd: rawnand: serialize lock/unlock against other NAND operations
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: serialize lock/unlock against other NAND operations
nandlock() and nandunlock() call into chip->ops.lockarea/unlockarea without holding the NAND device lock. On controllers that implement SETFEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmdpending conflicts on the NAND controller.
Add nandgetdevice()/nandreleasedevice() around the lock/unlock operations to serialize them against all other NAND controller access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel mtd: rawnand implementation, call nand_get_device() before nand_lock()/nand_unlock() invoke chip->ops.lock_area/unlock_area, and call nand_release_device() afterward to serialize these operations against other NAND controller access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23434?
The severity of CVE-2026-23434 is high with a score of 7.1.
How do I fix CVE-2026-23434?
To fix CVE-2026-23434, you should update the Linux kernel to the latest patched version that addresses this vulnerability.
What impact does CVE-2026-23434 have on Linux systems?
CVE-2026-23434 can lead to potential data corruption or denial of service on systems using vulnerable NAND flash devices.
Which versions of the Linux kernel are affected by CVE-2026-23434?
CVE-2026-23434 affects specific versions of the Linux kernel prior to the release of the patch that addresses this vulnerability.
Is CVE-2026-23434 exploitable remotely?
CVE-2026-23434 has a low attack vector rating, making remote exploitation less likely but still possible under certain conditions.