GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89954 (GCVE-0-2026-89954)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40
VLAI
Title
mtd: afs: validate v2 image info bounds
Summary
In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer[8] to locate the image information block inside the current erase block, then uses the image information region_count to walk entries from a fixed local array. The footer offset and region count come from flash contents and are not checked against the erase block or the local image-info array before use. Reject v2 entries whose image information offset would underflow the erase block calculation, and reject region counts that cannot fit in the local image-info array before walking region entries.
Severity
8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b7cf5e2830bbb128699d7635ce8404b7f605bc95 , < 1bec05a68414cf8d0cab6cb42445b8603f32ffc4 (git)
Affected: b7cf5e2830bbb128699d7635ce8404b7f605bc95 , < 3ad8ff12fd44b08af9212ac4883a7e29d2ab7348 (git)
Affected: b7cf5e2830bbb128699d7635ce8404b7f605bc95 , < 875daa3c750814ff2e2dc050239c390048f0bcd0 (git)
Affected: b7cf5e2830bbb128699d7635ce8404b7f605bc95 , < da740539e8f370767317e24615349b9342a6e773 (git)
Affected: b7cf5e2830bbb128699d7635ce8404b7f605bc95 , < 1edea8900ca3e405c1421d8b5c29f97107874f72 (git)
Affected: b7cf5e2830bbb128699d7635ce8404b7f605bc95 , < 18916f475057cbd2fb8ea6ae86e6b85884ad1d53 (git)
Affected: b7cf5e2830bbb128699d7635ce8404b7f605bc95 , < d14e6298139f58a87a87d7022e26a7f37f0ddce7 (git)
Affected: b7cf5e2830bbb128699d7635ce8404b7f605bc95 , < e9290031f736e99ad17c25c00311c92c266843b7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/parsers/afs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1bec05a68414cf8d0cab6cb42445b8603f32ffc4",
              "status": "affected",
              "version": "b7cf5e2830bbb128699d7635ce8404b7f605bc95",
              "versionType": "git"
            },
            {
              "lessThan": "3ad8ff12fd44b08af9212ac4883a7e29d2ab7348",
              "status": "affected",
              "version": "b7cf5e2830bbb128699d7635ce8404b7f605bc95",
              "versionType": "git"
            },
            {
              "lessThan": "875daa3c750814ff2e2dc050239c390048f0bcd0",
              "status": "affected",
              "version": "b7cf5e2830bbb128699d7635ce8404b7f605bc95",
              "versionType": "git"
            },
            {
              "lessThan": "da740539e8f370767317e24615349b9342a6e773",
              "status": "affected",
              "version": "b7cf5e2830bbb128699d7635ce8404b7f605bc95",
              "versionType": "git"
            },
            {
              "lessThan": "1edea8900ca3e405c1421d8b5c29f97107874f72",
              "status": "affected",
              "version": "b7cf5e2830bbb128699d7635ce8404b7f605bc95",
              "versionType": "git"
            },
            {
              "lessThan": "18916f475057cbd2fb8ea6ae86e6b85884ad1d53",
              "status": "affected",
              "version": "b7cf5e2830bbb128699d7635ce8404b7f605bc95",
              "versionType": "git"
            },
            {
              "lessThan": "d14e6298139f58a87a87d7022e26a7f37f0ddce7",
              "status": "affected",
              "version": "b7cf5e2830bbb128699d7635ce8404b7f605bc95",
              "versionType": "git"
            },
            {
              "lessThan": "e9290031f736e99ad17c25c00311c92c266843b7",
              "status": "affected",
              "version": "b7cf5e2830bbb128699d7635ce8404b7f605bc95",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/parsers/afs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: afs: validate v2 image info bounds\n\nThe AFS v2 parser uses footer[8] to locate the image information block\ninside the current erase block, then uses the image information\nregion_count to walk entries from a fixed local array. The footer offset\nand region count come from flash contents and are not checked against the\nerase block or the local image-info array before use.\n\nReject v2 entries whose image information offset would underflow the\nerase block calculation, and reject region counts that cannot fit in the\nlocal image-info array before walking region entries."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The AFS v2 parser runs from parse_mtd_partitions() during local MTD/physmap probe, reading on-flash ARM Firmware Suite footers via mtd_read(); no network protocol, Bluetooth/Wi-Fi path, or USB gadget/host handler invokes this code.\nAC:L - An attacker who controls the flash image can plant valid AFS v2 magic and CRC and set footer[8] and region_count arbitrarily, so the unsigned info-block offset and the region walk run deterministically with no race or layout condition outside attacker control.\nPR:N - parse_afs_partitions() runs automatically at boot/probe on affected ARM/physmap systems with no credential or capability check; crafted AFS metadata can be delivered in firmware/OTA/supply-chain flash contents without a local OS account.\nUI:N - Partition parsing runs as part of MTD driver initialization at boot or bind; no separate victim action such as mounting a filesystem or opening a device node is required.\nS:U - The stack over-read and any resulting oops remain inside the host kernel; this is not a VM escape, IOMMU bypass, or sandbox breakout.\nC:H - Attacker-controlled region_count drives an unbounded read past the on-stack imginfo[36] array, and kstrdup() of a possibly non-NUL-terminated footer name can copy that kernel stack/adjacent memory into a partition name far beyond a small bounded leak.\nI:L - OOB-derived region offset/size and repeated kstrdup() results are stored in the registered mtd_partition object, modifying kernel flash-layout metadata, but the loop does not perform an out-of-bounds write or yield a control-flow hijack primitive.\nA:H - Walking region_count past imginfo[] reaches unmapped stack or vmalloc pages and oopses or panics the kernel; a huge count can also livelock probe and exhaust memory via kstrdup in the loop."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:40:35.830Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1bec05a68414cf8d0cab6cb42445b8603f32ffc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ad8ff12fd44b08af9212ac4883a7e29d2ab7348"
        },
        {
          "url": "https://git.kernel.org/stable/c/875daa3c750814ff2e2dc050239c390048f0bcd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/da740539e8f370767317e24615349b9342a6e773"
        },
        {
          "url": "https://git.kernel.org/stable/c/1edea8900ca3e405c1421d8b5c29f97107874f72"
        },
        {
          "url": "https://git.kernel.org/stable/c/18916f475057cbd2fb8ea6ae86e6b85884ad1d53"
        },
        {
          "url": "https://git.kernel.org/stable/c/d14e6298139f58a87a87d7022e26a7f37f0ddce7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9290031f736e99ad17c25c00311c92c266843b7"
        }
      ],
      "title": "mtd: afs: validate v2 image info bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89954",
    "datePublished": "2026-09-16T10:32:38.355Z",
    "dateReserved": "2026-09-11T19:38:34.777Z",
    "dateUpdated": "2026-09-16T14:40:35.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89954\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:17:05.667\",\"lastModified\":\"2026-09-16T15:18:20.140\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmtd: afs: validate v2 image info bounds\\n\\nThe AFS v2 parser uses footer[8] to locate the image information block\\ninside the current erase block, then uses the image information\\nregion_count to walk entries from a fixed local array. The footer offset\\nand region count come from flash contents and are not checked against the\\nerase block or the local image-info array before use.\\n\\nReject v2 entries whose image information offset would underflow the\\nerase block calculation, and reject region counts that cannot fit in the\\nlocal image-info array before walking region entries.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/mtd/parsers/afs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b7cf5e2830bbb128699d7635ce8404b7f605bc95\",\"lessThan\":\"1bec05a68414cf8d0cab6cb42445b8603f32ffc4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cf5e2830bbb128699d7635ce8404b7f605bc95\",\"lessThan\":\"3ad8ff12fd44b08af9212ac4883a7e29d2ab7348\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cf5e2830bbb128699d7635ce8404b7f605bc95\",\"lessThan\":\"875daa3c750814ff2e2dc050239c390048f0bcd0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cf5e2830bbb128699d7635ce8404b7f605bc95\",\"lessThan\":\"da740539e8f370767317e24615349b9342a6e773\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cf5e2830bbb128699d7635ce8404b7f605bc95\",\"lessThan\":\"1edea8900ca3e405c1421d8b5c29f97107874f72\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cf5e2830bbb128699d7635ce8404b7f605bc95\",\"lessThan\":\"18916f475057cbd2fb8ea6ae86e6b85884ad1d53\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cf5e2830bbb128699d7635ce8404b7f605bc95\",\"lessThan\":\"d14e6298139f58a87a87d7022e26a7f37f0ddce7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7cf5e2830bbb128699d7635ce8404b7f605bc95\",\"lessThan\":\"e9290031f736e99ad17c25c00311c92c266843b7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/mtd/parsers/afs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.5}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18916f475057cbd2fb8ea6ae86e6b85884ad1d53\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1bec05a68414cf8d0cab6cb42445b8603f32ffc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1edea8900ca3e405c1421d8b5c29f97107874f72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3ad8ff12fd44b08af9212ac4883a7e29d2ab7348\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/875daa3c750814ff2e2dc050239c390048f0bcd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d14e6298139f58a87a87d7022e26a7f37f0ddce7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/da740539e8f370767317e24615349b9342a6e773\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e9290031f736e99ad17c25c00311c92c266843b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.