NAND Flash Command Execution Issue in TP-Link Archer AX55 by Qualcomm

CVE-2026-80712

What is CVE-2026-80712?

A vulnerability has been identified in the TP-Link Archer AX55's NAND flash handling due to an off-by-one error in the command execution logic. The issue arises from the timing of writing the feature value to the NAND_FLASH_FEATURES register, which occurs after the command execution instead of before. This leads to incorrect values being read and written, rendering the chip unable to operate correctly and causing the device to become unbootable. With the recent enhancements in SPI-NAND OTP support, this vulnerability highlights a significant risk as it can permanently disable the flash memory, leading to data loss and device malfunction. The patch outlined resolves the timing issue, ensuring that feature values are correctly applied during the same transaction as the command execution, restoring the device's functionality.

References