CVE-2026-80712

A flaw was found in the Linux kernel's spi-qpic-snand driver. This vulnerability arises from an incorrect timing issue where the SET_FEATURE command for SPI-NAND flash devices is executed before the intended feature value is properly written. Consequently, the device is programmed with an outdated value, and the correct setting is only applied during a subsequent operation. This 'off-by-one' error can lead to critical system instability, specifically by causing the flash memory to remain in One-Time Programmable (OTP) mode if it was enabled. This renders the flash unusable, preventing data access and potentially making the device unbootable.

A moderate severity flaw was found in the Linux kernel Qualcomm QPIC SPI-NAND controller driver (spi-qpic-snand). The driver executes the SPINAND_SET_FEATURE command before the intended feature value is written to the NAND_FLASH_FEATURES register, so each feature write is applied one operation late and the chip is programmed with a stale register value from a previous operation. On systems using SPI-NAND OTP support (added upstream in v6.18), this off-by-one behavior can leave the chip in OTP mode during MTD registration, causing subsequent array reads to return OTP-area contents and all writes to fail, which can render the SPI-NAND flash unusable and leave the device unbootable. This is a local functional defect in the driver's command sequencing rather than a memory-corruption issue: the practical consequence is denial of service against the flash device on affected hardware, not compromise of confidentiality or integrity. For this reason Red Hat rates the flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVEORG rating of Important (8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes no privileges required and full confidentiality and integrity impact. Based on the current assessment, all Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams listed in this flaw are not affected because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.