Junglewise Threat Intelligence

CVE-2026-46190: Linux kernel out-of-bounds read in spi_nor_params_show

CVE-2026-46190 · Severity: info · CVSS 0 · Published 2026-05-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's SPI-NOR flash memory driver. This component is responsible for managing certain types of flash storage used in embedded systems and servers. An error in how the system displays internal parameters through the debug interface could allow an attacker to read memory outside of the intended boundaries, potentially leading to system instability or the exposure of sensitive information.

Technical details

An out-of-bounds read vulnerability exists in the 'spi_nor_params_show()' function within 'drivers/mtd/spi-nor/debugfs.c'. The root cause is the incorrect use of 'sizeof()' instead of 'ARRAY_SIZE()' when passing the 'snor_f_names' array to 'spi_nor_print_flags()'. Because 'snor_f_names' is an array of pointers, 'sizeof()' returns the total byte count (element count multiplied by pointer size) rather than the number of elements. On 64-bit systems, this results in a length value eight times larger than intended. If a flag bit is set that exceeds the actual array count but falls within the inflated byte-size range, the kernel performs an out-of-bounds read. This is reachable via the debugfs interface, typically requiring local access with sufficient privileges to read debugfs entries.

Affected products

  • Linux Linux kernel Fixed in versions 34bdcfb, 9a80c45, c0b654b, ca18c18, e47029b

Timeline

  • 2026-04-17: disclosed: Vulnerability identified and patch authored by Tudor Ambarus.
  • 2026-05-28: advisory: CVE-2026-46190 published.

References

Related threats