CVE-2026-72155

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mtd: spi-nor: swp: Improve locking user experience

In the case of the first block being locked (or the few first blocks),

if the user want to fully unlock the device it has two possibilities:

- either it asks to unlock the entire device, and this works;

- or it asks to unlock just the block(s) that are currently locked,

which fails.

It fails because the conditions "can_be_top" and "can_be_bottom" are

true. Indeed, in this case, we unlock everything, so the TB bit does not

matter. However in the current implementation, use_top would be true (as

this is the favourite option) and lock_len, which in practice should be

reduced down to 0, is set to "nor->params->size - (ofs + len)" which is

a positive number. This is wrong.

An easy way is to simply add an extra condition. In the unlock() path,

if we can achieve the same result from both sides, it means we unlock

everything and lock_len must simply be 0. A comment is ad

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References