PT-2026-44313 · Opensuse+1 · Opensuse Tumbleweed+1
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1
Description
An out-of-bounds read exists in the
spi nor params show() function within the spi-nor debugfs component. The issue occurs because the snor f names array is passed to the spi nor print flags() function using sizeof(), which returns the total byte size of the pointer array rather than the number of elements. On 64-bit systems, this results in a length eight times larger than intended. If a flag bit is set that exceeds the actual element count but falls within the inflated byte-size count, the names len argument fails to properly bounds-check the names array access, leading to an out-of-bounds read.Recommendations
Update to a version where
ARRAY SIZE() is used instead of sizeof() to pass the actual number of string pointers in the array.
Update to kernel-devel-7.0.11-1.1 or a newer version.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Opensuse Tumbleweed