Executive brief
The Linux kernel's SPI-NOR flash memory controller contains a logic error in the software write protection (swp) subsystem that prevents users from unlocking flash memory blocks in certain scenarios. When the first few blocks of a flash device are locked, attempting to unlock only those specific blocks fails due to incorrect calculation of the locked region length, even though the operation should succeed. This can impair the usability and manageability of flash-based storage devices used in embedded systems, networking equipment, and IoT devices.
Technical details
The vulnerability is a logic error in the SPI-NOR flash memory write protection unlock function (spi_nor_sr_unlock in drivers/mtd/spi-nor/swp.c). The issue occurs when both "can_be_top" and "can_be_bottom" boolean conditions are true, indicating that the entire flash device can be unlocked regardless of which protection scheme (Top or Bottom) is used. However, the original code incorrectly calculates lock_len (the length of the region that should remain locked) as a positive number instead of 0, causing the unlock operation to fail. The fix adds a conditional check: when both can_be_top and can_be_bottom are true, lock_len is explicitly set to 0. This is a local issue requiring direct kernel access; no remote attack vector is present. The patch was merged upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel affected versions include Linux 3.x through 6.x and later; patch fixes commit 3dd8012a8eeb onwards
Timeline
- 2026-05-26: other: Patch authored by Miquel Raynal
- 2026-07-24: patched: Patch committed to stable kernel tree
- 2026-08-15: disclosed: CVE-2026-72155 published