CVE-2026-72155

A flaw was found in the Linux kernel's mtd: spi-nor: swp component. When a user attempts to unlock specific blocks on a Serial Peripheral Interface (SPI) NOR flash device, particularly those at the beginning of the device, the operation may fail. This occurs due to an incorrect calculation of the lock_len parameter, which prevents the intended blocks from being unlocked. The consequence is that the user's request to unlock certain flash memory regions is not properly executed, potentially leading to unexpected device behavior or operational limitations.

A low impact flaw was found in the Linux kernel SPI NOR flash memory software write protection (mtd: spi-nor: swp) implementation. When the first block or first few blocks of a SPI NOR flash device are locked and a user with local access and the privileges needed to change SPI NOR write protection requests to unlock only those currently locked blocks, the operation fails because lock_len is incorrectly calculated as a positive value (nor->params->size - (ofs + len)) instead of 0. This local functional defect in the flash protection control path can prevent expected write or update operations on the affected flash regions; there is no evidence of memory corruption, information disclosure, or privilege escalation, and confidentiality is not affected.

Red Hat Enterprise Linux 6, 7, and 8 (kernel and kernel-rt) are not affected because the vulnerable code is not present in those releases. Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 are affected; the fix has been deferred to a future update given the low security impact of this functional bug. The residual risk is limited to the failure of block-level unlock requests, since the device can still be fully unlocked by requesting an unlock of the entire device. Red Hat rates the impact of this flaw as Low even though the CVSS:3.1 base score of 5.5 (Moderate) reflects a high availability impact, because the defect only affects the SPI NOR unlock operation under specific block-locking configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A workaround is available: instead of requesting an unlock of only the block(s) that are currently locked (for example the first block(s) of the device), request an unlock of the entire device, which succeeds. A fix for the affected Red Hat products is deferred and will be delivered in a future update.