SB2026082861 - Improper Initialization in Linux kernel spi driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-80712)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware register initialization in the spi-qpic-snand driver when processing SPINAND_SET_FEATURE operations. A local user can trigger crafted SPI-NAND feature-setting operations to cause a denial of service.

This can leave the flash device stuck in OTP mode, causing subsequent array reads to return the OTP area and writes to fail, which can render the device unbootable.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3ba021079ef2ac6e21e3547328496ac42d22b56a
• https://git.kernel.org/stable/c/581e5166f0780103dc91c0d8ebc801f9af4824b0
• https://git.kernel.org/stable/c/8fd62901d6bf03f274a49dd0060793cc07dd51b0