CVE-2026-23434
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: serialize lock/unlock against other NAND operations nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller. Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-04-03 16:16:24.913000
Last modified
2026-10-19 19:17:47.890000
View original CVE JSON
{
"id": "CVE-2026-23434",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-04-03T16:16:24.913",
"lastModified": "2026-10-19T19:17:47.890",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: serialize lock/unlock against other NAND operations\n\nnand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area\nwithout holding the NAND device lock. On controllers that implement\nSET_FEATURES via multiple low-level PIO commands, these can race with\nconcurrent UBI/UBIFS background erase/write operations that hold the\ndevice lock, resulting in cmd_pending conflicts on the NAND controller.\n\nAdd nand_get_device()/nand_release_device() around the lock/unlock\noperations to serialize them against all other NAND controller access."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmtd: rawnand: serializar bloqueo/desbloqueo contra otras operaciones NAND\n\nnand_lock() y nand_unlock() llaman a chip -> ops.lock_area/unlock_area sin mantener el bloqueo del dispositivo NAND. En controladores que implementan SET_FEATURES a través de múltiples comandos PIO de bajo nivel, estos pueden competir con operaciones concurrentes de borrado/escritura en segundo plano de UBI/UBIFS que mantienen el bloqueo del dispositivo, resultando en conflictos de cmd_pending en el controlador NAND.\n\nAñadir nand_get_device()/nand_release_device() alrededor de las operaciones de bloqueo/desbloqueo para serializarlas contra todo otro acceso al controlador NAND."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/mtd/nand/raw/nand_base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "92270086b7e5ada7ab381c06cc3da2e95ed17088",
"lessThan": "28ea836cc44cb8b89c1c174707ead0c1133c60e9",
"versionType": "git",
"status": "affected"
},
{
"version": "92270086b7e5ada7ab381c06cc3da2e95ed17088",
"lessThan": "fe4a73c3dd48308149d57a10c2761e1d36ced7ba",
"versionType": "git",
"status": "affected"
},
{
"version": "92270086b7e5ada7ab381c06cc3da2e95ed17088",
"lessThan": "ce5229e78078e437704157eb542f43a6f83b429b",
"versionType": "git",
"status": "affected"
},
{
"version": "92270086b7e5ada7ab381c06cc3da2e95ed17088",
"lessThan": "a80291e577b44593a724d6cd64c14337c78f194d",
"versionType": "git",
"status": "affected"
},
{
"version": "92270086b7e5ada7ab381c06cc3da2e95ed17088",
"lessThan": "f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2",
"versionType": "git",
"status": "affected"
},
{
"version": "92270086b7e5ada7ab381c06cc3da2e95ed17088",
"lessThan": "5fd5c078af23cb353507aa522e09d557d7eaef04",
"versionType": "git",
"status": "affected"
},
{
"version": "92270086b7e5ada7ab381c06cc3da2e95ed17088",
"lessThan": "f25446e2c28939753d3b62d34dfda49952b2557d",
"versionType": "git",
"status": "affected"
},
{
"version": "92270086b7e5ada7ab381c06cc3da2e95ed17088",
"lessThan": "bab2bc6e850a697a23b9e5f0e21bb8c187615e95",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/mtd/nand/raw/nand_base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.7",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.7",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.253",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.203",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.167",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.130",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.78",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.20",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.10",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:08:00.897129Z",
"id": "CVE-2026-23434",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.1",
"versionEndExcluding": "5.10.253",
"matchCriteriaId": "44827F4D-4242-412D-B59A-6D9F5FC547B1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.203",
"matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.167",
"matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.130",
"matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.78",
"matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.20",
"matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.10",
"matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*",
"matchCriteriaId": "3D23CE42-BDB2-4216-8495-230ABE98FCDD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/28ea836cc44cb8b89c1c174707ead0c1133c60e9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5fd5c078af23cb353507aa522e09d557d7eaef04",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a80291e577b44593a724d6cd64c14337c78f194d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/bab2bc6e850a697a23b9e5f0e21bb8c187615e95",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ce5229e78078e437704157eb542f43a6f83b429b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f25446e2c28939753d3b62d34dfda49952b2557d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/fe4a73c3dd48308149d57a10c2761e1d36ced7ba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}