CVE-2026-80712

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18

Description An issue exists in the spi-qpic-snand driver where the qcom spi send cmdaddr() function programs NAND FLASH CMD/NAND EXEC CMD and submits descriptors, causing the controller to execute the command immediately. For SPINAND SET FEATURE operations, the value to be written is only placed into NAND FLASH FEATURES during a second submission by qcom spi io op(). This results in the chip being programmed with a value from a previous operation, causing the intended value to be applied only during the subsequent SET FEATURE call.

This behavior can lead to a state where the chip remains in OTP (One-Time Programmable) mode because the command to disable it actually applies a previous enable request. Consequently, array reads return the OTP area instead of the main array, and all write operations fail with an -EIO error due to write protection. This can render the flash unusable and the device unbootable.

Additionally, the driver previously dereferenced a 4-byte pointer on a one-byte buffer spinand->scratchbuf.

Recommendations Update the Linux kernel to version 6.18 or later. As a temporary mitigation, restrict the use of SPI-NAND OTP functions if they are not required for system operation.