CVE-2026-89954

Published: Set 16, 2026 Last Modified: Set 16, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,0

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector: local

Attack Complexity: low

Privileges Required: none

User Interaction: none

Scope: unchanged

Confidentiality: high

Integrity: low

Availability: high

Description

AI Translation Available

In the Linux kernel, the following vulnerability has been resolved:

mtd: afs: validate v2 image info bounds

The AFS v2 parser uses footer[8] to locate the image information block
inside the current erase block, then uses the image information
region_count to walk entries from a fixed local array. The footer offset
and region count come from flash contents and are not checked against the
erase block or the local image-info array before use.

Reject v2 entries whose image information offset would underflow the
erase block calculation, and reject region counts that cannot fit in the
local image-info array before walking region entries.