In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: serialize lock/unlock against other NAND operations

nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area
without holding the NAND device lock. On controllers that implement
SET_FEATURES via multiple low-level PIO commands, these can race with
concurrent UBI/UBIFS background erase/write operations that hold the
device lock, resulting in cmd_pending conflicts on the NAND controller.

Add nand_get_device()/nand_release_device() around the lock/unlock
operations to serialize them against all other NAND controller access.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
92270086b7e5ada7ab381c06cc3da2e95ed17088 affected < ce5229e78078e437704157eb542f43a6f83b429b
92270086b7e5ada7ab381c06cc3da2e95ed17088 affected < a80291e577b44593a724d6cd64c14337c78f194d
92270086b7e5ada7ab381c06cc3da2e95ed17088 affected < f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2
92270086b7e5ada7ab381c06cc3da2e95ed17088 affected < 5fd5c078af23cb353507aa522e09d557d7eaef04
92270086b7e5ada7ab381c06cc3da2e95ed17088 affected < f25446e2c28939753d3b62d34dfda49952b2557d
92270086b7e5ada7ab381c06cc3da2e95ed17088 affected < bab2bc6e850a697a23b9e5f0e21bb8c187615e95
Linux Linux affected
Version Status Constraints
5.7 affected —
0 unaffected < 5.7
6.1.167 unaffected ≤ 6.1.*
6.6.130 unaffected ≤ 6.6.*
6.12.78 unaffected ≤ 6.12.*
6.18.20 unaffected ≤ 6.18.*
6.19.10 unaffected ≤ 6.19.*
7.0-rc5 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/5fd5c078af23cb353507aa522e09d557d7eaef04 cve-icon cve-icon
https://git.kernel.org/stable/c/a80291e577b44593a724d6cd64c14337c78f194d cve-icon cve-icon
https://git.kernel.org/stable/c/bab2bc6e850a697a23b9e5f0e21bb8c187615e95 cve-icon cve-icon
https://git.kernel.org/stable/c/ce5229e78078e437704157eb542f43a6f83b429b cve-icon cve-icon
https://git.kernel.org/stable/c/f25446e2c28939753d3b62d34dfda49952b2557d cve-icon cve-icon
https://git.kernel.org/stable/c/f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2 cve-icon cve-icon
History

Fri, 03 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: serialize lock/unlock against other NAND operations nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller. Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access.
Title mtd: rawnand: serialize lock/unlock against other NAND operations
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-04-03T15:15:19.450Z

Reserved: 2026-01-13T15:37:46.016Z

Link: CVE-2026-23434

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-03T16:16:24.913

Modified: 2026-04-03T16:16:24.913

Link: CVE-2026-23434

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.