Executive brief
The Linux kernel's AFS v2 partition parser, which parses flash memory partition tables, fails to validate values read from flash storage before using them to access memory arrays. An attacker with the ability to modify or supply malicious flash memory contents could trigger out-of-bounds memory access, causing a kernel crash or denial of service on systems using affected devices.
Technical details
The vulnerability is an out-of-bounds memory access in the AFS v2 partition parser (drivers/mtd/parsers/afs.c). The parser reads image information offset and region count values directly from flash footer data without validating that the offset does not cause integer underflow during erase-block calculations, or that the region count fits within the fixed local imginfo array bounds. An attacker with control over flash contents can craft malicious footer or image information data to bypass these bounds checks and trigger an out-of-bounds read or write. The attack requires local access to a device with physical flash storage, making the attack vector local. Patches add explicit validation checks for erase block size, image information offset bounds, and region count array bounds before processing partition data.
Affected products
- Linux Linux kernel all versions up to and including 6.18 (specific range inferred from patch applicability across multiple stable branches)
Timeline
- 2026-09-16: disclosed: CVE-2026-89954 published
- 2026-07-08: patched: Patch committed upstream by Pengpeng Hou
- 2026-09-11: other: Patch included in stable kernel releases