A logic flaw in the Linux kernel SPI-NAND driver may result in data corruption and permanent device unbootability, posing a high risk to system availability.

The vulnerability exists in the spi-qpic-snand driver where the feature value is written after the SET_FEATURE command is executed. This off-by-one timing error causes the controller to program the SPI-NAND chip with stale register values, which can inadvertently enable OTP mode, prevent normal array access, and render the device unbootable.

Successful exploitation of this flaw leads to a complete loss of system availability, as the device becomes unable to boot or access its storage media. Given the CVSS score of 8.4, this vulnerability is categorized as high severity because it enables a local attacker to cause a permanent denial of service, requiring manual hardware intervention or firmware recovery to remediate.

Immediate Action: Update the Linux kernel to version 6.18.44, 7.1.8, or a later stable release where this logic error has been corrected.

Proactive Monitoring: Monitor system logs for I/O errors or unexpected transitions into OTP mode, particularly on devices utilizing the spi-qpic-snand controller.

Compensating Controls: Restrict local access to systems utilizing the affected SPI-NAND hardware to prevent unauthorized configuration changes that could trigger the vulnerability.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to system integrity and uptime. Organizations running Linux kernels on hardware utilizing the spi-qpic-snand driver should prioritize testing and deploying the provided kernel patches immediately to prevent potential device bricking.