CVE-2026-72165 (GCVE-0-2026-72165)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:41
VLAI
Title
mtd: rawnand: fix condition in 'nand_select_target()'
Summary
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nand_select_target()' 'cs' here must be in range [0:nanddev_ntargets[.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 32813e288414fecce18f37f8f0d0414a64b45c56 , < 483a8a8581ee1274ec70e2561492096d4a7305e6 (git)
Affected: 32813e288414fecce18f37f8f0d0414a64b45c56 , < c2a131fb6882c98aada739479cc96df8748d0c24 (git)
Affected: 32813e288414fecce18f37f8f0d0414a64b45c56 , < e6df4fea1dc86c058e1918136c9b9d8e80c4be1b (git)
Affected: 32813e288414fecce18f37f8f0d0414a64b45c56 , < 3da4eb15c7b421c2d97c402bb7bd607c44822995 (git)
Affected: 32813e288414fecce18f37f8f0d0414a64b45c56 , < fbc7c8a1167b2eb56b2fd8598c29a3d5e9f8676e (git)
Affected: 32813e288414fecce18f37f8f0d0414a64b45c56 , < 4bbfcf9c7e46cae58257150bf834853559382e28 (git)
Affected: 32813e288414fecce18f37f8f0d0414a64b45c56 , < 8f575fc17360827ca1d1940a84f3c7ee40407a10 (git)
Affected: 32813e288414fecce18f37f8f0d0414a64b45c56 , < 8507c2cc9e4fa402401819f44d1e8a5ef4d11d8b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/nand/raw/nand_base.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "483a8a8581ee1274ec70e2561492096d4a7305e6",
              "status": "affected",
              "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
              "versionType": "git"
            },
            {
              "lessThan": "c2a131fb6882c98aada739479cc96df8748d0c24",
              "status": "affected",
              "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
              "versionType": "git"
            },
            {
              "lessThan": "e6df4fea1dc86c058e1918136c9b9d8e80c4be1b",
              "status": "affected",
              "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
              "versionType": "git"
            },
            {
              "lessThan": "3da4eb15c7b421c2d97c402bb7bd607c44822995",
              "status": "affected",
              "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
              "versionType": "git"
            },
            {
              "lessThan": "fbc7c8a1167b2eb56b2fd8598c29a3d5e9f8676e",
              "status": "affected",
              "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
              "versionType": "git"
            },
            {
              "lessThan": "4bbfcf9c7e46cae58257150bf834853559382e28",
              "status": "affected",
              "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
              "versionType": "git"
            },
            {
              "lessThan": "8f575fc17360827ca1d1940a84f3c7ee40407a10",
              "status": "affected",
              "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
              "versionType": "git"
            },
            {
              "lessThan": "8507c2cc9e4fa402401819f44d1e8a5ef4d11d8b",
              "status": "affected",
              "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/nand/raw/nand_base.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: fix condition in \u0027nand_select_target()\u0027\n\n\u0027cs\u0027 here must be in range [0:nanddev_ntargets[."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the raw NAND MTD stack reached via local /dev/mtdX character-device ioctls (MEMREAD, MEMWRITE, MEMERASE, MEMSETBADBLOCK) and mtdblock I/O, not via network protocols or physical hotplug alone.\nAC:L - An attacker with MTD device access can repeatedly issue read, write, or erase operations on multi-die NAND hardware; when a caller supplies cs equal to nanddev_ntargets(), the defective check passes deterministically and invokes the controller select_chip path.\nPR:L - Exploitation requires local write access to the MTD character device (FMODE_WRITE on /dev/mtdX) but no capability() gate beyond device permissions; per kernel CNA guidance, PR:L is chosen when uncertain between device-permission low and root-only high privilege.\nUI:N - No separate victim interaction is required; once the attacker has access to the MTD device node they can trigger the vulnerable nand_select_target() path through their own ioctl or read/write requests.\nS:U - Impact remains within the kernel and on-board NAND controller security authority on the host; it does not cross VM, container, IOMMU, or other security-boundary scopes into a separate authority.\nC:H - When cs equals nanddev_ntargets() the invalid index reaches controller select_chip handlers (denali, mtk, rockchip, renesas) that index sels[cs] without bounds checking, enabling out-of-bounds kernel memory reads.\nI:H - Out-of-bounds sels[cs] values are written into NAND controller CE-select and timing registers, plausibly corrupting flash contents or protection state; under the required uncertainty rule this memory-safety defect is scored as high integrity impact.\nA:H - On legacy/default select_chip paths an out-of-range cs hits BUG(), and controller misconfiguration from invalid CE selection can oops or hang the kernel, satisfying high availability impact for kernel crash classes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:07.143Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/483a8a8581ee1274ec70e2561492096d4a7305e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2a131fb6882c98aada739479cc96df8748d0c24"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6df4fea1dc86c058e1918136c9b9d8e80c4be1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3da4eb15c7b421c2d97c402bb7bd607c44822995"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbc7c8a1167b2eb56b2fd8598c29a3d5e9f8676e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bbfcf9c7e46cae58257150bf834853559382e28"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f575fc17360827ca1d1940a84f3c7ee40407a10"
        },
        {
          "url": "https://git.kernel.org/stable/c/8507c2cc9e4fa402401819f44d1e8a5ef4d11d8b"
        }
      ],
      "title": "mtd: rawnand: fix condition in \u0027nand_select_target()\u0027",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72165",
    "datePublished": "2026-08-15T05:53:32.649Z",
    "dateReserved": "2026-08-09T03:40:39.909Z",
    "dateUpdated": "2026-08-17T05:41:07.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72165",
      "date": "2026-09-21",
      "epss": "0.00164",
      "percentile": "0.06024"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mtd/nand/raw/nand_base.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "483a8a8581ee1274ec70e2561492096d4a7305e6",
                    "status": "affected",
                    "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c2a131fb6882c98aada739479cc96df8748d0c24",
                    "status": "affected",
                    "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e6df4fea1dc86c058e1918136c9b9d8e80c4be1b",
                    "status": "affected",
                    "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3da4eb15c7b421c2d97c402bb7bd607c44822995",
                    "status": "affected",
                    "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fbc7c8a1167b2eb56b2fd8598c29a3d5e9f8676e",
                    "status": "affected",
                    "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4bbfcf9c7e46cae58257150bf834853559382e28",
                    "status": "affected",
                    "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8f575fc17360827ca1d1940a84f3c7ee40407a10",
                    "status": "affected",
                    "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8507c2cc9e4fa402401819f44d1e8a5ef4d11d8b",
                    "status": "affected",
                    "version": "32813e288414fecce18f37f8f0d0414a64b45c56",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mtd/nand/raw/nand_base.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: fix condition in \u0027nand_select_target()\u0027\n\n\u0027cs\u0027 here must be in range [0:nanddev_ntargets[."
          }
        ],
        "id": "CVE-2026-72165",
        "lastModified": "2026-08-17T06:18:16.860",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:34.490",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3da4eb15c7b421c2d97c402bb7bd607c44822995"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/483a8a8581ee1274ec70e2561492096d4a7305e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4bbfcf9c7e46cae58257150bf834853559382e28"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8507c2cc9e4fa402401819f44d1e8a5ef4d11d8b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f575fc17360827ca1d1940a84f3c7ee40407a10"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c2a131fb6882c98aada739479cc96df8748d0c24"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e6df4fea1dc86c058e1918136c9b9d8e80c4be1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fbc7c8a1167b2eb56b2fd8598c29a3d5e9f8676e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T05:26:27+00:00",
      "cve": "CVE-2026-72165",
      "id": "CVE-2026-72165",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mtd: rawnand: fix condition in \u0027nand_select_target()\u0027",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72165.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:29:44Z",
      "cve": "CVE-2026-72165",
      "id": "CVE-2026-72165",
      "initial_release_date": "2026-08-31T13:29:44Z",
      "product_status:known_affected": "228",
      "product_status:known_not_affected": "134",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72165",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72165.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.