CVE-2026-89954: mtd: afs: validate v2 image info bounds
In the Linux kernel, the following vulnerability has been resolved:
mtd: afs: validate v2 image info bounds
The AFS v2 parser uses footer[8] to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. The footer offset and region count come from flash contents and are not checked against the erase block or the local image-info array before use.
Reject v2 entries whose image information offset would underflow the erase block calculation, and reject region counts that cannot fit in the local image-info array before walking region entries.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The AFS v2 parser must process flash contents containing a v2 entry with a crafted image-information offset or region count. Those values are read from the flash contents and were previously used without validating that the offset remains within the current erase block or that the region count fits the local image-info array.
What should be checked when assessing exposure?
Determine whether the system uses the Linux kernel AFS v2 parser and processes the relevant flash image contents. Inspect v2 entries for image-information offsets that could underflow the erase-block calculation and region counts larger than the parser's local image-info array can hold.