CVE-2026-80712

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

spi: spi-qpic-snand: write the feature value before executing SET_FEATURE

qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits

the descriptors, which makes the controller execute the command

immediately. For SPINAND_SET_FEATURE the value to be written is only

placed into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a

second submission - so the chip is programmed with whatever that register

happened to hold from a previous operation, and the intended value is only

applied by the *next* SET_FEATURE.

Measured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing

0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the

subsequent write of 0x00 leaves it at 0x40 - every write lands one

operation late.

This stayed unnoticed until v6.18 added SPI-NAND OTP support together

with OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode,

reads, and disables it a

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References