PT-2026-44313 · Linux · Linux
Published
2026-05-28
·
Updated
2026-05-28
·
CVE-2026-46190
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
mtd: spi-nor: debugfs: fix out-of-bounds read in spi nor params show()
Sashiko noticed an out-of-bounds read [1].
In spi nor params show(), the snor f names array is passed to
spi nor print flags() using sizeof(snor f names).
Since snor f names is an array of pointers, sizeof() returns the total
number of bytes occupied by the pointers
(element count * sizeof(void *))
rather than the element count itself. On 64-bit systems, this makes the
passed length 8x larger than intended.
Inside spi nor print flags(), the 'names len' argument is used to
bounds-check the 'names' array access. An out-of-bounds read occurs
if a flag bit is set that exceeds the array's actual element count
but is within the inflated byte-size count.
Correct this by using ARRAY SIZE() to pass the actual number of
string pointers in the array.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux