Improper Initialization in Linux kernel - CVE-2026-80712
Published: August 28, 2026
Vulnerability identifier: #VU146080
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80712
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper hardware register initialization in the spi-qpic-snand driver when processing SPINAND_SET_FEATURE operations. A local user can trigger crafted SPI-NAND feature-setting operations to cause a denial of service.
This can leave the flash device stuck in OTP mode, causing subsequent array reads to return the OTP area and writes to fail, which can render the device unbootable.
Affected software
Linux kernel
How to mitigate CVE-2026-80712
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3