CVE-2026-89954

mtd: afs: validate v2 image info bounds

State: Published
Severity: 8.0 High
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: afs: validate v2 image info bounds

The AFS v2 parser uses footer[8] to locate the image information block inside the current erase block, then uses the image information region_count to walk entries from a fixed local array. The footer offset and region count come from flash contents and are not checked against the erase block or the local image-info array before use.

Reject v2 entries whose image information offset would underflow the erase block calculation, and reject region counts that cannot fit in the local image-info array before walking region entries.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 1bec05a68414cf8d0cab6cb42445b8603f32ffc4Affected b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 3ad8ff12fd44b08af9212ac4883a7e29d2ab7348Affected b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 875daa3c750814ff2e2dc050239c390048f0bcd0Affected b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before da740539e8f370767317e24615349b9342a6e773Affected b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 1edea8900ca3e405c1421d8b5c29f97107874f72Affected b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 18916f475057cbd2fb8ea6ae86e6b85884ad1d53Affected b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before d14e6298139f58a87a87d7022e26a7f37f0ddce7Affected b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before e9290031f736e99ad17c25c00311c92c266843b7Affected
LinuxLinux	5.2Affected before 5.2Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 1bec05a68414cf8d0cab6cb42445b8603f32ffc4Affected
b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 3ad8ff12fd44b08af9212ac4883a7e29d2ab7348Affected
b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 875daa3c750814ff2e2dc050239c390048f0bcd0Affected
b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before da740539e8f370767317e24615349b9342a6e773Affected
b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 1edea8900ca3e405c1421d8b5c29f97107874f72Affected
b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before 18916f475057cbd2fb8ea6ae86e6b85884ad1d53Affected
b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before d14e6298139f58a87a87d7022e26a7f37f0ddce7Affected
b7cf5e2830bbb128699d7635ce8404b7f605bc95 to before e9290031f736e99ad17c25c00311c92c266843b7Affected

LinuxLinux

5.2Affected
before 5.2Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.