{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-72165",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-72165"
  ],
  "published": "2026-08-15T06:04:33Z",
  "summary": "mtd: rawnand: fix condition in 'nand_select_target()'",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: fix condition in 'nand_select_target()'\n\n'cs' here must be in range [0:nanddev_ntargets[.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72165"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/483a8a8581ee1274ec70e2561492096d4a7305e6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c2a131fb6882c98aada739479cc96df8748d0c24"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e6df4fea1dc86c058e1918136c9b9d8e80c4be1b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3da4eb15c7b421c2d97c402bb7bd607c44822995"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/fbc7c8a1167b2eb56b2fd8598c29a3d5e9f8676e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4bbfcf9c7e46cae58257150bf834853559382e28"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8f575fc17360827ca1d1940a84f3c7ee40407a10"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8507c2cc9e4fa402401819f44d1e8a5ef4d11d8b"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:50:24Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The flaw is in the raw NAND MTD stack reached via local /dev/mtdX character-device ioctls (MEMREAD, MEMWRITE, MEMERASE, MEMSETBADBLOCK) and mtdblock I/O, not via network protocols or physical hotplug alone.\nAC:L - An attacker with MTD device access can repeatedly issue read, write, or erase operations on multi-die NAND hardware; when a caller supplies cs equal to nanddev_ntargets(), the defective check passes deterministically and invokes the controller select_chip path.\nPR:L - Exploitation requires local write access to the MTD character device (FMODE_WRITE on /dev/mtdX) but no capability() gate beyond device permissions; per kernel CNA guidance, PR:L is chosen when uncertain between device-permission low and root-only high privilege.\nUI:N - No separate victim interaction is required; once the attacker has access to the MTD device node they can trigger the vulnerable nand_select_target() path through their own ioctl or read/write requests.\nS:U - Impact remains within the kernel and on-board NAND controller security authority on the host; it does not cross VM, container, IOMMU, or other security-boundary scopes into a separate authority.\nC:H - When cs equals nanddev_ntargets() the invalid index reaches controller select_chip handlers (denali, mtk, rockchip, renesas) that index sels[cs] without bounds checking, enabling out-of-bounds kernel memory reads.\nI:H - Out-of-bounds sels[cs] values are written into NAND controller CE-select and timing registers, plausibly corrupting flash contents or protection state; under the required uncertainty rule this memory-safety defect is scored as high integrity impact.\nA:H - On legacy/default select_chip paths an out-of-range cs hits BUG(), and controller misconfiguration from invalid CE selection can oops or hang the kernel, satisfying high availability impact for kernel crash classes."
    }
  }
}