Junglewise Threat Intelligence

CVE-2026-23434: Linux Kernel race condition in mtd rawnand driver

CVE-2026-23434 · Severity: high · CVSS 7.1 · Published 2026-04-03

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A race condition vulnerability was identified in the Linux kernel's NAND flash memory management component. This component is responsible for handling data storage on physical flash chips used in various embedded systems and industrial controllers. An exploit could allow a local attacker to cause system instability or data corruption by triggering conflicting commands during background storage operations.

Technical details

A race condition exists in the mtd: rawnand component of the Linux kernel. The functions nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without acquiring the necessary NAND device lock. On controllers implementing SET_FEATURES via multiple PIO commands, this allows a race with concurrent UBI/UBIFS background operations (like erase or write). This results in cmd_pending conflicts on the NAND controller, potentially leading to data corruption or denial of service. The fix involves wrapping lock/unlock operations with nand_get_device() and nand_release_device() to ensure proper serialization.

Affected products

  • Linux Linux Kernel Fixed in versions 28ea836, 5fd5c07, a80291e, bab2bc6, ce5229e, f25446e, f71ce0a, fe4a73c
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-05: other: Patch authored
  • 2026-04-03: disclosed: Vulnerability published

References

Related threats