CVE-2026-89952: mtd: rawnand: validate ONFI extended parameter page sections
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: validate ONFI extended parameter page sections
nandflashdetectextparampage() allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It reads that header and advances over sections without first proving that the fixed page and each current section fit in the allocation.
Reject pages shorter than the fixed header, track the remaining variable area while walking sections, and require the ECC section to contain every field read from struct onfiexteccinfo. Use device-scoped diagnostics that identify the malformed ONFI section.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
They need to provide or cause the kernel to read a NAND device with a malformed ONFI extended parameter page. The malformed page must declare lengths or sections that are too short for the fixed header, a section being traversed, or the ECC fields the driver reads.
Which systems are realistically exposed?
Systems using the Linux kernel raw NAND subsystem and detecting NAND devices through ONFI extended parameter pages are the relevant exposure. The provided information does not identify affected kernel versions or hardware models.
How can I determine whether a device is affected or being rejected after the fix?
Check kernel diagnostics during NAND detection for device-scoped messages identifying a malformed ONFI section. The fix rejects parameter pages that are shorter than the fixed header, overrun the remaining variable area, or contain an undersized ECC section.