CVE-2026-46190: mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
In the Linux kernel, the following vulnerability has been resolved:
mtd: spi-nor: debugfs: fix out-of-bounds read in spinorparamsshow()
Sashiko noticed an out-of-bounds read [1].
In spinorparamsshow(), the snorfnames array is passed to spinorprintflags() using sizeof(snorfnames).
Since snorfnames is an array of pointers, sizeof() returns the total number of bytes occupied by the pointers (elementcount sizeof(void )) rather than the element count itself. On 64-bit systems, this makes the passed length 8x larger than intended.
Inside spinorprintflags(), the 'nameslen' argument is used to bounds-check the 'names' array access. An out-of-bounds read occurs if a flag bit is set that exceeds the array's actual element count but is within the inflated byte-size count.
Correct this by using ARRAYSIZE() to pass the actual number of string pointers in the array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
In spi_nor_params_show(), update the code that passes snor_f_names to spi_nor_print_flags() so that the length argument uses ARRAY_SIZE(snor_f_names) (element count) rather than sizeof(snor_f_names) (byte-size inflated on 64-bit). Also ensure that spi_nor_print_flags() bounds-checks the 'names' array access using the element count derived from ARRAY_SIZE().
Linux kernel (mtd: spi-nor) Use ARRAY_SIZE() instead of sizeof() when passing the element count for snor_f_names = ARRAY_SIZE(snor_f_names)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46190?
CVE-2026-46190 has a severity rating of high with a CVSS score of 7.1.
How do I fix CVE-2026-46190?
To fix CVE-2026-46190, you should update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-46190?
CVE-2026-46190 is an out-of-bounds read vulnerability in the Linux kernel MTD SPI-NOR debugfs implementation.
What impact does CVE-2026-46190 have on systems?
The impact of CVE-2026-46190 can lead to potential information disclosure due to the out-of-bounds read.
Who discovered CVE-2026-46190?
CVE-2026-46190 was discovered by an individual named Sashiko.