The kernel fault causes the value written to a NAND feature register to be applied one command late, because the SET_FEATURE operation writes the feature value after the command is already executed. On systems that use SPI‑NAND OTP support, this off‑by‑one error means that a configuration write intended to disable OTP mode actually applies the previous value, leaving the chip permanently in OTP mode. Subsequent array reads therefore return the OTP area and all writes fail, rendering the flash unusable and preventing the system from booting. Additionally, the code dereferences a pointer larger than the intended buffer when copying data into the scratch buffer, which could lead to memory corruption and instability if an attacker can influence the contents. The impact is primarily data integrity and availability loss; no evidence of remote code execution is present in the disclosed behavior.

Linux kernel releases that include the SPI‑NAND driver for QPIC SPINAND chips, particularly versions that added OTP support such as 6.18 and later. Devices that implement the OTP feature, like the TP‑Link Archer AX55 v1 (IPQ5018 SoC with ESMT NAND), have demonstrably experienced flash corruption and boot failure.

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV. The CVSS score is 8.4, indicating high severity. The flaw occurs in low-level flash handling code and requires local code execution or the ability to trigger SPI‑NAND writes. The attack vector is not explicitly documented, but the described scenario implies that a local attacker capable of influencing kernel flash operations could exploit the bug. The severity is high because the flaw directly destroys the boot media, and the exploit would render the device unusable.