CVE-2026-72155
Estado: RecibidaSin puntuar—
In the Linux kernel, the following vulnerability has been resolved:
mtd: spi-nor: swp: Improve locking user experience
In the case of the first block being locked (or the few first blocks), if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire device, and this works; - or it asks to unlock just the block(s) that are currently locked, which fails.
It fails because the conditions "can_be_top" and "can_be_bottom" are true. Indeed, in this case, we unlock everything, so the TB bit does not matter.
Leer descripción completaMostrar menos
However in the current implementation, use_top would be true (as this is the favourite option) and lock_len, which in practice should be reduced down to 0, is set to "nor->params->size - (ofs + len)" which is a positive number. This is wrong.
An easy way is to simply add an extra condition. In the unlock() path, if we can achieve the same result from both sides, it means we unlock everything and lock_len must simply be 0. A comment is added to clarify that logic.
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.22%
- Percentil entre todas las CVEs puntuadas: 11
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/12d4d69221159e6d0e72400ec81195d691169b53
- https://git.kernel.org/stable/c/23c285be8f6fcde9088fe12bb69c701d46696be1
- https://git.kernel.org/stable/c/6110ab5ffd84e8daa654652446a03ce2f77580a7
- https://git.kernel.org/stable/c/9a0d8dec3d11ca95d67537ea8fa6ee2730a5038a
- https://git.kernel.org/stable/c/a6fd2145c73b80bb6a5eed7355a4f63597d712d9
- https://git.kernel.org/stable/c/c0806df5cf806545160f3fdac3c888926ceac557
- https://git.kernel.org/stable/c/dc341272cf8e15a2c511db3c4df5dab8adf70ad0
- https://git.kernel.org/stable/c/e1d456b26bf23e30db305a6184e8abd9ab68bbf2
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-72155",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3dd8012a8eeb3702fa17450ec1a16a3f38af138d",
"lessThan": "23c285be8f6fcde9088fe12bb69c701d46696be1",
"versionType": "git"
},
{
"status": "affected",
"version": "3dd8012a8eeb3702fa17450ec1a16a3f38af138d",
"lessThan": "a6fd2145c73b80bb6a5eed7355a4f63597d712d9",
"versionType": "git"
},
{
"status": "affected",
"version": "3dd8012a8eeb3702fa17450ec1a16a3f38af138d",
"lessThan": "9a0d8dec3d11ca95d67537ea8fa6ee2730a5038a",
"versionType": "git"
},
{
"status": "affected",
"version": "3dd8012a8eeb3702fa17450ec1a16a3f38af138d",
"lessThan": "dc341272cf8e15a2c511db3c4df5dab8adf70ad0",
"versionType": "git"
},
{
"status": "affected",
"version": "3dd8012a8eeb3702fa17450ec1a16a3f38af138d",
"lessThan": "6110ab5ffd84e8daa654652446a03ce2f77580a7",
"versionType": "git"
},
{
"status": "affected",
"version": "3dd8012a8eeb3702fa17450ec1a16a3f38af138d",
"lessThan": "c0806df5cf806545160f3fdac3c888926ceac557",
"versionType": "git"
},
{
"status": "affected",
"version": "3dd8012a8eeb3702fa17450ec1a16a3f38af138d",
"lessThan": "12d4d69221159e6d0e72400ec81195d691169b53",
"versionType": "git"
},
{
"status": "affected",
"version": "3dd8012a8eeb3702fa17450ec1a16a3f38af138d",
"lessThan": "e1d456b26bf23e30db305a6184e8abd9ab68bbf2",
"versionType": "git"
}
],
"programFiles": [
"drivers/mtd/spi-nor/swp.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/mtd/spi-nor/swp.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-15T06:21:33.250",
"references": [
{
"url": "https://git.kernel.org/stable/c/12d4d69221159e6d0e72400ec81195d691169b53",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/23c285be8f6fcde9088fe12bb69c701d46696be1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6110ab5ffd84e8daa654652446a03ce2f77580a7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9a0d8dec3d11ca95d67537ea8fa6ee2730a5038a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a6fd2145c73b80bb6a5eed7355a4f63597d712d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0806df5cf806545160f3fdac3c888926ceac557",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dc341272cf8e15a2c511db3c4df5dab8adf70ad0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e1d456b26bf23e30db305a6184e8abd9ab68bbf2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spi-nor: swp: Improve locking user experience\n\nIn the case of the first block being locked (or the few first blocks),\nif the user want to fully unlock the device it has two possibilities:\n- either it asks to unlock the entire device, and this works;\n- or it asks to unlock just the block(s) that are currently locked,\n which fails.\n\nIt fails because the conditions \"can_be_top\" and \"can_be_bottom\" are\ntrue. Indeed, in this case, we unlock everything, so the TB bit does not\nmatter. However in the current implementation, use_top would be true (as\nthis is the favourite option) and lock_len, which in practice should be\nreduced down to 0, is set to \"nor->params->size - (ofs + len)\" which is\na positive number. This is wrong.\n\nAn easy way is to simply add an extra condition. In the unlock() path,\nif we can achieve the same result from both sides, it means we unlock\neverything and lock_len must simply be 0. A comment is added to clarify\nthat logic."
}
],
"lastModified": "2026-08-23T13:16:40.843",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}