The kernel fault causes the value written to a NAND feature register to be applied one command late, because the SET_FEATURE operation writes the feature value after the command is already executed. On systems that use SPI‑NAND OTP support, this off‑by‑one error means that a configuration write meant to disable OTP mode actually applies the previous value and leaves the chip permanently in OTP mode. Subsequent array reads therefore return the OTP area and all writes fail, rendering the flash unusable and preventing the system from booting. The code also dereferences a pointer larger than the intended buffer when copying data into the scratch buffer. This memory corruption could lead to shellcode execution or other instability if an attacker can influence the contents. Both effects compromise data integrity, availability, and may allow privilege escalation if an attacker can trigger the faulty write sequence.

Linux kernel releases that include the SPI‑NAND driver for QPIC SPINAND chips, particularly versions that added OTP support such as 6.18 and later. Devices that implement the OTP feature, like the TP‑Link Archer AX55 v1 (IPQ5018 SoC with ESMT NAND), have demonstrably experienced flash corruption and boot failure.

No EPSS score is available and the vulnerability is not listed in CISA KEV. The flaw occurs in low‑level flash handling code and requires code execution on the system to trigger the faulty write. A local attacker who can inject commands to the kernel K‑module or trigger SPI‑NAND writes can lock the device in OTP mode. The severity is high because the bug directly destroys the boot media, and the attack path is trivial once an attacker has the ability to influence kernel flash operations.