Linux Linux Kernel Out-Of-Bounds Read Rated 7.1 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-46190

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()

Sashiko noticed an out-of-bounds read [1].

In spi_nor_params_show(), the snor_f_names array is passed to

spi_nor_print_flags() using sizeof(snor_f_names).

Since snor_f_names is an array of pointers, sizeof() returns the total

number of bytes occupied by the pointers

(element_count * sizeof(void *))

rather than the element count itself. On 64-bit systems, this makes the

passed length 8x larger than intended.

Inside spi_nor_print_flags(), the 'names_len' argument is used to

bounds-check the 'names' array access. An out-of-bounds read occurs

if a flag bit is set that exceeds the array's actual element count

but is within the inflated byte-size count.

Correct this by using ARRAY_SIZE() to pass the actual number of

string pointers in the array. (NVD)

What to Do

Monitor Linux's and Siemens's web pages for any future patch releases.

References