CVE-2026-68466
Description
A flaw was found in the Linux kernel's lpc32xx_slc driver, which manages NAND flash memory. This vulnerability occurs because the driver fails to properly handle Direct Memory Access (DMA) transfer timeouts. When a DMA transfer times out, the driver incorrectly reports it as successful and unmaps the associated memory buffer without terminating the DMA channel. This can lead to the system attempting to access an unmapped memory region, potentially causing data corruption or system instability.
Statement
This vulnerability is rated as Moderate severity because it requires local access and is restricted to platforms utilizing specialized NXP LPC32xx embedded hardware, limiting the potential denial-of-service impact to systems containing these physical controllers. Red Hat Enterprise Linux does not support this embedded SoC architecture, and the associated raw NAND storage driver is not compiled into Red Hat kernels. As a result, supported Red Hat enterprise environments do not package the affected code and are not impacted.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
