CVE-2026-80712 Overview
CVE-2026-80712 is a Linux kernel vulnerability in the spi-qpic-snand driver used with Qualcomm QPIC SPI-NAND controllers. The flaw causes the driver to submit SET_FEATURE commands before writing the intended feature value into the NAND_FLASH_FEATURES register. As a result, every SET_FEATURE operation applies a value from a previous transaction rather than the requested one. When SPI-NAND OTP support was added in kernel v6.18, this off-by-one behavior left affected chips stuck in OTP mode, rendering flash reads inconsistent and writes impossible. Devices such as the TP-Link Archer AX55 v1 (IPQ5018 with ESMT F50L1G41LB NAND) became unbootable.
Critical Impact
The off-by-one SET_FEATURE sequencing can leave affected SPI-NAND flash chips permanently in OTP mode, breaking storage integrity, failing all writes with -EIO, and bricking the device on affected Qualcomm IPQ platforms.
Affected Products
- Linux kernel builds containing the spi-qpic-snand driver, notably v6.18 which introduced SPI-NAND OTP support
- Qualcomm IPQ-based platforms using QPIC SPI-NAND controllers (for example, IPQ5018)
- Devices with ESMT SPI-NAND chips such as the F50L1G41LB, including the TP-Link Archer AX55 v1
Discovery Timeline
- 2026-08-28 - CVE-2026-80712 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80712
Vulnerability Analysis
The defect resides in the Qualcomm QPIC SPI-NAND driver at drivers/spi/spi-qpic-snand.c. The function qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD and NAND_EXEC_CMD and submits the descriptors, which triggers the controller to execute the command immediately. For SPINAND_SET_FEATURE, the intended feature value is only written to NAND_FLASH_FEATURES afterward in a second submission through qcom_spi_io_op(). The controller therefore programs the chip with whatever value that register held from the previous operation. The intended value only takes effect on the next SET_FEATURE call.
An additional defect exists in the same code path: the previous implementation dereferenced a 4-byte pointer over a one-byte scratch buffer (spinand->scratchbuf), copying more bytes than the operation actually carried.
Root Cause
The root cause is an ordering error in how the driver constructs the transaction. NAND_EXEC_CMD is issued before NAND_FLASH_FEATURES is populated with the operand for the command. This is a state-management flaw where controller register writes are sequenced incorrectly relative to command execution.
Attack Vector
The issue is local and does not require authentication or user interaction. Exploitation is not the primary concern; the impact is corruption of persistent storage state on affected devices. On systems that enable SPI-NAND OTP support introduced in kernel v6.18, the disable-OTP write actually applies the previous value, leaving CFG_OTP_ENABLE set. Subsequent array reads return the OTP area rather than user data, UBI reports an empty device, and all writes fail with -EIO because OTP is write-protected. On affected boards the flash becomes unusable and the device fails to boot.
No verified exploit code examples are available. See the upstream commits referenced below for the corrected transaction sequence.
Detection Methods for CVE-2026-80712
Indicators of Compromise
- Kernel logs reporting -EIO on all writes to the SPI-NAND MTD device shortly after mtd_otp_nvmem_add() runs during boot
- UBI attach failures or UBI reporting the underlying MTD device as empty on hardware known to contain a populated filesystem
- Boot failures on Qualcomm IPQ platforms using ESMT SPI-NAND after upgrading to kernel v6.18 or later
Detection Strategies
- Compare live SPI-NAND reads against a known-good full flash image; a mismatch where reads return OTP content instead of the array indicates the bug is active
- Audit kernel version and driver source for the pre-patch ordering of NAND_EXEC_CMD and NAND_FLASH_FEATURES in qcom_spi_send_cmdaddr()
- Monitor MTD subsystem messages during boot for OTP mode being left enabled after spinand_otp_rw() completes
Monitoring Recommendations
- Track kernel versions across fleets of Qualcomm IPQ-based network devices and flag builds derived from v6.18 without the fix commits
- Log and alert on repeated MTD write failures and UBI attach errors from embedded devices in centralized log infrastructure
- Include SPI-NAND health checks in device provisioning and firmware update pipelines
How to Mitigate CVE-2026-80712
Immediate Actions Required
- Apply the upstream Linux kernel fixes from the referenced stable commits before deploying kernels derived from v6.18 to affected hardware
- Avoid rolling out v6.18-derived kernels that enable SPI-NAND OTP support on Qualcomm IPQ platforms with ESMT SPI-NAND until the driver patch is present
- Validate boot and flash integrity on a pilot device before mass deployment to production hardware
Patch Information
The fix writes the feature value into NAND_FLASH_FEATURES as part of the same transaction, before NAND_EXEC_CMD, and copies only the bytes the operation actually carries. Refer to Linux Kernel Commit 3ba0210, Linux Kernel Commit 581e516, and Linux Kernel Commit 8fd6290 for the corrected implementation.
Workarounds
- Remain on kernel versions prior to v6.18 where SPI-NAND OTP registration does not trigger the faulty SET_FEATURE sequence on affected chips
- Disable SPI-NAND OTP registration in the kernel configuration for affected boards if downstream builds allow it
- Maintain verified full-flash backups of affected devices so recovery is possible if a device enters the stuck OTP state
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
