Executive brief
The Linux kernel's NAND flash driver processes Extended Parameter Page (EPP) data from ONFI-compliant flash memory devices without proper bounds checking. An attacker with control over malformed NAND flash device responses could trigger a buffer over-read, potentially exposing kernel memory or causing a denial of service during device initialization.
Technical details
The vulnerability is a buffer over-read in the nand_flash_detect_ext_param_page() function in drivers/mtd/nand/raw/nand_onfi.c. The function allocates a buffer based on the length field in an ONFI parameter page, then parses the buffer as a fixed header followed by variable-length sections without validating that the header or sections fit within the allocated size. An attacker-controlled NAND device could provide a truncated EPP (shorter than the fixed header) or sections that extend beyond the allocated buffer. The fix adds explicit bounds checking: rejecting pages shorter than the fixed header size, tracking remaining buffer space while iterating sections, and verifying the ECC section contains all required fields. Attack vector is adjacent (direct device connection/NAND interface) or local with device control. No user interaction is required.
Affected products
- Linux Linux kernel various versions through 6.9 and earlier stable branches
Timeline
- 2026-09-16: disclosed: CVE-2026-89952 published
- 2026-07-20: patched: Fix committed upstream by Pengpeng Hou
- 2026-09-14: patched: Fix backported to stable branches