Vulnerability-Lookup

CVE-2026-80712 (GCVE-0-2026-80712)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-29 06:22

Title

spi: spi-qpic-snand: write the feature value before executing SET_FEATURE

Summary

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SET_FEATURE qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits the descriptors, which makes the controller execute the command immediately. For SPINAND_SET_FEATURE the value to be written is only placed into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a second submission - so the chip is programmed with whatever that register happened to hold from a previous operation, and the intended value is only applied by the *next* SET_FEATURE. Measured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing 0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the subsequent write of 0x00 leaves it at 0x40 - every write lands one operation late. This stayed unnoticed until v6.18 added SPI-NAND OTP support together with OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode, reads, and disables it again, and mtd_otp_nvmem_add() does this during MTD registration. With the off-by-one, the "disable" write actually applies the previously requested value, so CFG_OTP_ENABLE ends up set: the chip stays in OTP mode, every subsequent array read returns the OTP area instead of the array (UBI reports an empty device) and all writes fail with -EIO because the OTP area is write protected. On this board that makes the whole flash unusable and the device unbootable. Write the feature value into NAND_FLASH_FEATURES as part of the same transaction, before NAND_EXEC_CMD. While at it, copy only the bytes the operation actually carries - the previous code dereferenced a 4-byte pointer on a one-byte buffer (spinand->scratchbuf). With this patch the flash contents read back bit-identical to a known-good dump of the same board taken under the vendor firmware (md5-verified across partitions), and writes work.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/581e5166f0780103d…
https://git.kernel.org/stable/c/3ba021079ef2ac6e2…
https://git.kernel.org/stable/c/8fd62901d6bf03f27…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 7304d1909080ef0c9da703500a97f46c98393fcd , < 581e5166f0780103dc91c0d8ebc801f9af4824b0 (git) Affected: 7304d1909080ef0c9da703500a97f46c98393fcd , < 3ba021079ef2ac6e21e3547328496ac42d22b56a (git) Affected: 7304d1909080ef0c9da703500a97f46c98393fcd , < 8fd62901d6bf03f274a49dd0060793cc07dd51b0 (git)	guessed
Linux	Linux	Affected: 6.15 Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-qpic-snand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "581e5166f0780103dc91c0d8ebc801f9af4824b0",
              "status": "affected",
              "version": "7304d1909080ef0c9da703500a97f46c98393fcd",
              "versionType": "git"
            },
            {
              "lessThan": "3ba021079ef2ac6e21e3547328496ac42d22b56a",
              "status": "affected",
              "version": "7304d1909080ef0c9da703500a97f46c98393fcd",
              "versionType": "git"
            },
            {
              "lessThan": "8fd62901d6bf03f274a49dd0060793cc07dd51b0",
              "status": "affected",
              "version": "7304d1909080ef0c9da703500a97f46c98393fcd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-qpic-snand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-qpic-snand: write the feature value before executing SET_FEATURE\n\nqcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits\nthe descriptors, which makes the controller execute the command\nimmediately. For SPINAND_SET_FEATURE the value to be written is only\nplaced into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a\nsecond submission - so the chip is programmed with whatever that register\nhappened to hold from a previous operation, and the intended value is only\napplied by the *next* SET_FEATURE.\n\nMeasured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing\n0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the\nsubsequent write of 0x00 leaves it at 0x40 - every write lands one\noperation late.\n\nThis stayed unnoticed until v6.18 added SPI-NAND OTP support together\nwith OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode,\nreads, and disables it again, and mtd_otp_nvmem_add() does this during\nMTD registration. With the off-by-one, the \"disable\" write actually\napplies the previously requested value, so CFG_OTP_ENABLE ends up set:\nthe chip stays in OTP mode, every subsequent array read returns the OTP\narea instead of the array (UBI reports an empty device) and all writes\nfail with -EIO because the OTP area is write protected. On this board\nthat makes the whole flash unusable and the device unbootable.\n\nWrite the feature value into NAND_FLASH_FEATURES as part of the same\ntransaction, before NAND_EXEC_CMD. While at it, copy only the bytes the\noperation actually carries - the previous code dereferenced a 4-byte\npointer on a one-byte buffer (spinand-\u003escratchbuf).\n\nWith this patch the flash contents read back bit-identical to a\nknown-good dump of the same board taken under the vendor firmware\n(md5-verified across partitions), and writes work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the onboard Qualcomm QPIC SPI-NAND driver reached via spi_mem/MTD during driver probe and flash operations; it is not reachable through network protocols, only local kernel flash/MTD paths on embedded SoCs (IPQ5018/IPQ9574 routers, APs, gateways).\nAC:L - Every SPINAND_SET_FEATURE is deterministically one operation late because NAND_EXEC_CMD fires before NAND_FLASH_FEATURES is programmed; the OTP disable-after-read sequence reliably leaves CFG_OTP_ENABLE set without races or attacker-uncontrollable timing.\nPR:N - No attacker privileges are required once an affected kernel runs: mtd_device_parse_register() calls mtd_otp_nvmem_add() during boot, which triggers spinand_otp_rw() and bricks flash on ESMT chips with OTP support without any userspace or admin action.\nUI:N - Exploitation requires no victim interaction; the vulnerable OTP read path runs automatically during MTD registration at driver probe/boot on affected Qualcomm platforms with ESMT SPI-NAND OTP tables added in v6.18.\nS:U - Impact is confined to the same kernel/flash security boundary on the embedded device; there is no cross-VM, cross-container, or IOMMU boundary bypass\u2014only persistent corruption of onboard SPI-NAND chip configuration and flash availability.\nC:H - When OTP mode sticks enabled, all subsequent array reads return OTP contents instead of normal flash data, disclosing factory OTP region data; the pre-fix 4-byte dereference on a 1-byte SET_FEATURE buffer also programs stale register bytes into the chip.\nI:H - Misprogrammed feature registers persistently corrupt SPI-NAND configuration; the demonstrated OTP-mode lock leaves the OTP area write-protected, all flash writes fail with -EIO, UBI sees an empty device, and the router becomes permanently unbootable until hardware reflash.\nA:H - Affected devices suffer complete loss of boot flash availability\u2014the commit documents whole-flash unusability and unbootable TP-Link Archer AX55 boards, constituting total persistent denial of service on consumer WiFi routers and Qualcomm embedded gateways."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:28.248Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/581e5166f0780103dc91c0d8ebc801f9af4824b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ba021079ef2ac6e21e3547328496ac42d22b56a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fd62901d6bf03f274a49dd0060793cc07dd51b0"
        }
      ],
      "title": "spi: spi-qpic-snand: write the feature value before executing SET_FEATURE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80712",
    "datePublished": "2026-08-28T06:53:11.243Z",
    "dateReserved": "2026-08-26T14:34:25.788Z",
    "dateUpdated": "2026-08-29T06:22:28.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80712",
      "date": "2026-08-28",
      "epss": "0.00154",
      "percentile": "0.04896"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80712\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:56.850\",\"lastModified\":\"2026-08-29T07:16:52.640\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: spi-qpic-snand: write the feature value before executing SET_FEATURE\\n\\nqcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits\\nthe descriptors, which makes the controller execute the command\\nimmediately. For SPINAND_SET_FEATURE the value to be written is only\\nplaced into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a\\nsecond submission - so the chip is programmed with whatever that register\\nhappened to hold from a previous operation, and the intended value is only\\napplied by the *next* SET_FEATURE.\\n\\nMeasured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing\\n0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the\\nsubsequent write of 0x00 leaves it at 0x40 - every write lands one\\noperation late.\\n\\nThis stayed unnoticed until v6.18 added SPI-NAND OTP support together\\nwith OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode,\\nreads, and disables it again, and mtd_otp_nvmem_add() does this during\\nMTD registration. With the off-by-one, the \\\"disable\\\" write actually\\napplies the previously requested value, so CFG_OTP_ENABLE ends up set:\\nthe chip stays in OTP mode, every subsequent array read returns the OTP\\narea instead of the array (UBI reports an empty device) and all writes\\nfail with -EIO because the OTP area is write protected. On this board\\nthat makes the whole flash unusable and the device unbootable.\\n\\nWrite the feature value into NAND_FLASH_FEATURES as part of the same\\ntransaction, before NAND_EXEC_CMD. While at it, copy only the bytes the\\noperation actually carries - the previous code dereferenced a 4-byte\\npointer on a one-byte buffer (spinand-\u003escratchbuf).\\n\\nWith this patch the flash contents read back bit-identical to a\\nknown-good dump of the same board taken under the vendor firmware\\n(md5-verified across partitions), and writes work.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/spi/spi-qpic-snand.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7304d1909080ef0c9da703500a97f46c98393fcd\",\"lessThan\":\"581e5166f0780103dc91c0d8ebc801f9af4824b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7304d1909080ef0c9da703500a97f46c98393fcd\",\"lessThan\":\"3ba021079ef2ac6e21e3547328496ac42d22b56a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7304d1909080ef0c9da703500a97f46c98393fcd\",\"lessThan\":\"8fd62901d6bf03f274a49dd0060793cc07dd51b0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/spi/spi-qpic-snand.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3ba021079ef2ac6e21e3547328496ac42d22b56a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/581e5166f0780103dc91c0d8ebc801f9af4824b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8fd62901d6bf03f274a49dd0060793cc07dd51b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}

FKIE_CVE-2026-80712

Vulnerability from fkie_nvd - Published: 2026-08-28 08:16 - Updated: 2026-08-29 07:16

Severity

8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3ba021079ef2ac6e21e3547328496ac42d22b56a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/581e5166f0780103dc91c0d8ebc801f9af4824b0
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8fd62901d6bf03f274a49dd0060793cc07dd51b0

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-qpic-snand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "581e5166f0780103dc91c0d8ebc801f9af4824b0",
              "status": "affected",
              "version": "7304d1909080ef0c9da703500a97f46c98393fcd",
              "versionType": "git"
            },
            {
              "lessThan": "3ba021079ef2ac6e21e3547328496ac42d22b56a",
              "status": "affected",
              "version": "7304d1909080ef0c9da703500a97f46c98393fcd",
              "versionType": "git"
            },
            {
              "lessThan": "8fd62901d6bf03f274a49dd0060793cc07dd51b0",
              "status": "affected",
              "version": "7304d1909080ef0c9da703500a97f46c98393fcd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-qpic-snand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-qpic-snand: write the feature value before executing SET_FEATURE\n\nqcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits\nthe descriptors, which makes the controller execute the command\nimmediately. For SPINAND_SET_FEATURE the value to be written is only\nplaced into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a\nsecond submission - so the chip is programmed with whatever that register\nhappened to hold from a previous operation, and the intended value is only\napplied by the *next* SET_FEATURE.\n\nMeasured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing\n0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the\nsubsequent write of 0x00 leaves it at 0x40 - every write lands one\noperation late.\n\nThis stayed unnoticed until v6.18 added SPI-NAND OTP support together\nwith OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode,\nreads, and disables it again, and mtd_otp_nvmem_add() does this during\nMTD registration. With the off-by-one, the \"disable\" write actually\napplies the previously requested value, so CFG_OTP_ENABLE ends up set:\nthe chip stays in OTP mode, every subsequent array read returns the OTP\narea instead of the array (UBI reports an empty device) and all writes\nfail with -EIO because the OTP area is write protected. On this board\nthat makes the whole flash unusable and the device unbootable.\n\nWrite the feature value into NAND_FLASH_FEATURES as part of the same\ntransaction, before NAND_EXEC_CMD. While at it, copy only the bytes the\noperation actually carries - the previous code dereferenced a 4-byte\npointer on a one-byte buffer (spinand-\u003escratchbuf).\n\nWith this patch the flash contents read back bit-identical to a\nknown-good dump of the same board taken under the vendor firmware\n(md5-verified across partitions), and writes work."
    }
  ],
  "id": "CVE-2026-80712",
  "lastModified": "2026-08-29T07:16:52.640",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-28T08:16:56.850",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3ba021079ef2ac6e21e3547328496ac42d22b56a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/581e5166f0780103dc91c0d8ebc801f9af4824b0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8fd62901d6bf03f274a49dd0060793cc07dd51b0"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-9P4V-MQ4J-FJV8

Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-28 09:31

Details

In the Linux kernel, the following vulnerability has been resolved:

spi: spi-qpic-snand: write the feature value before executing SET_FEATURE

qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits the descriptors, which makes the controller execute the command immediately. For SPINAND_SET_FEATURE the value to be written is only placed into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a second submission - so the chip is programmed with whatever that register happened to hold from a previous operation, and the intended value is only applied by the next SET_FEATURE.

Measured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing 0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the subsequent write of 0x00 leaves it at 0x40 - every write lands one operation late.

This stayed unnoticed until v6.18 added SPI-NAND OTP support together with OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode, reads, and disables it again, and mtd_otp_nvmem_add() does this during MTD registration. With the off-by-one, the "disable" write actually applies the previously requested value, so CFG_OTP_ENABLE ends up set: the chip stays in OTP mode, every subsequent array read returns the OTP area instead of the array (UBI reports an empty device) and all writes fail with -EIO because the OTP area is write protected. On this board that makes the whole flash unusable and the device unbootable.

Write the feature value into NAND_FLASH_FEATURES as part of the same transaction, before NAND_EXEC_CMD. While at it, copy only the bytes the operation actually carries - the previous code dereferenced a 4-byte pointer on a one-byte buffer (spinand->scratchbuf).

With this patch the flash contents read back bit-identical to a known-good dump of the same board taken under the vendor firmware (md5-verified across partitions), and writes work.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80712"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T08:16:56Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-qpic-snand: write the feature value before executing SET_FEATURE\n\nqcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits\nthe descriptors, which makes the controller execute the command\nimmediately. For SPINAND_SET_FEATURE the value to be written is only\nplaced into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a\nsecond submission - so the chip is programmed with whatever that register\nhappened to hold from a previous operation, and the intended value is only\napplied by the *next* SET_FEATURE.\n\nMeasured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing\n0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the\nsubsequent write of 0x00 leaves it at 0x40 - every write lands one\noperation late.\n\nThis stayed unnoticed until v6.18 added SPI-NAND OTP support together\nwith OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode,\nreads, and disables it again, and mtd_otp_nvmem_add() does this during\nMTD registration. With the off-by-one, the \"disable\" write actually\napplies the previously requested value, so CFG_OTP_ENABLE ends up set:\nthe chip stays in OTP mode, every subsequent array read returns the OTP\narea instead of the array (UBI reports an empty device) and all writes\nfail with -EIO because the OTP area is write protected. On this board\nthat makes the whole flash unusable and the device unbootable.\n\nWrite the feature value into NAND_FLASH_FEATURES as part of the same\ntransaction, before NAND_EXEC_CMD. While at it, copy only the bytes the\noperation actually carries - the previous code dereferenced a 4-byte\npointer on a one-byte buffer (spinand-\u003escratchbuf).\n\nWith this patch the flash contents read back bit-identical to a\nknown-good dump of the same board taken under the vendor firmware\n(md5-verified across partitions), and writes work.",
  "id": "GHSA-9p4v-mq4j-fjv8",
  "modified": "2026-08-28T09:31:50Z",
  "published": "2026-08-28T09:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80712"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3ba021079ef2ac6e21e3547328496ac42d22b56a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/581e5166f0780103dc91c0d8ebc801f9af4824b0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8fd62901d6bf03f274a49dd0060793cc07dd51b0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-80712 (GCVE-0-2026-80712)

FKIE_CVE-2026-80712

GHSA-9P4V-MQ4J-FJV8

Tags

Sightings

Nomenclature