CVE-2021-47055: mtd: require write permissions for locking and badblock ioctls

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-29 · updated 2026-08-04
Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: mtd: require write permissions for locking and badblock ioctls MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require write permission. Depending on the hardware MEMLOCK might even be write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK is always write-once. MEMSETBADBLOCK modifies the bad block table.

Affected products

Linux kernel: from 4.4.233 before 4.4.269; from 4.9.233 before 4.9.269; from 4.14.194 before 4.14.233; from 4.19.139 before 4.19.191; from 5.4.58 before 5.4.119; from 5.9 before 5.10.37 — fixed in 4.14.233, 4.19.191, 4.4.269, 4.9.269, 5.10.37, 5.11.21

How to fix

Upgrade to a fixed version: Linux kernel 4.14.233, 4.19.191, 4.4.269, 4.9.269. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47055 or the next vulnerability affects your stack