A race condition exists between nand_lock/unlock and other NAND operations within the Linux kernel's MTD rawnand driver. Because the driver calls chip->ops.lock_area and unlock_area without holding the device lock, concurrent UBI/UBIFS background erase/write tasks that hold the lock can interfere with PIO commands executed to set controller features. This can cause cmd_pending conflicts on the NAND controller, leading to corrupt writes, data loss, or temporary loss of controller service. The weakness is a concurrency flaw (CWE‑820).

All Linux systems that use the default RBC 'mtd: rawnand' driver and have NAND flash storage are impacted. The CNA vendor list references Linux:Linux, and the list of affected CPEs includes all Linux kernel versions, so any build containing this code path is potentially vulnerable until the patch is applied.

The CVSS base score of 7.1 indicates high severity. The EPSS score is under 1 %, suggesting a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker with sufficient privileges to trigger concurrent NAND operations—such as a privileged user or a malicious application that initiates UBI/UBIFS background erasures while nand_lock/unlock is invoked—could exploit the race. This is inferred from the description, as the official advisory does not detail an attack step. The outcome would be data corruption or a denial of service to the storage subsystem, but it does not provide remote code execution.