CVE-2026-89952 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: validate ONFI extended parameter page sections
nand_flash_detect_ext_param_page() allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It reads that header and advances over sections without first proving that the fixed page and each current section fit in the allocation.
Reject pages shorter than the fixed header, track the remaining variable area while walking sections, and require the ECC section to contain every field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics that identify the malformed ONFI section.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel's MTD raw NAND subsystem involves a critical buffer over-read condition within the function nand_flash_detect_ext_param_page, which is responsible for parsing ONFI extended parameter pages during flash memory initialization. This routine allocates a buffer based on the length field declared by the device itself and subsequently interprets this data as a structure comprising a fixed header followed by variable-length sections. The core technical flaw lies in the absence of rigorous bounds checking before accessing these structures. Specifically, the code proceeds to read the fixed header and iterate through subsequent variable-length sections without first verifying that the total length declared by the device is sufficient to contain at least the minimum required size of the fixed header. Furthermore, as the parser advances over each section, it fails to validate that the remaining data in the buffer meets or exceeds the expected size of the current section being processed. This lack of validation allows a maliciously crafted or malformed ONFI parameter page to cause the kernel to read beyond the allocated memory boundaries, potentially leading to information disclosure if sensitive kernel memory is exposed through these out-of-bounds reads, or causing system instability and crashes due to invalid data interpretation.
From an operational perspective, this vulnerability impacts the reliability of NAND flash storage initialization processes within embedded systems, servers, and other devices relying on Linux-based MTD subsystems. An attacker with physical access to hardware components capable of manipulating firmware parameters or intercepting communication during device enumeration could exploit this flaw by providing a crafted ONFI parameter page that declares an insufficient length while containing data structures that exceed the allocated buffer size. This exploitation vector is particularly dangerous because it occurs early in the boot process, potentially before many security mitigations are fully active. The consequence of such an attack ranges from denial of service through kernel panics to more severe outcomes where sensitive memory contents are leaked to user space or used for further privilege escalation attacks if combined with other vulnerabilities. The issue highlights a common class of errors in low-level hardware interaction code where trust is placed too heavily on external data sources without adequate sanitization and validation checks.
To address this vulnerability, the resolution involves implementing strict boundary validations within the parsing logic. First, the system must reject any ONFI parameter page that declares a length shorter than the minimum size required for the fixed header structure. Second, during the iteration through variable-length sections, the code now tracks the remaining available bytes in the buffer and ensures that each section's declared size does not exceed this remainder before attempting to read or process it. Additionally, specific validation is applied to the ECC (Error Correction Code) section, requiring it to contain every field defined in the struct onfi_ext_ecc_info structure to ensure data integrity and consistency. These changes are complemented by device-scoped diagnostic mechanisms that can identify and report malformed ONFI sections, aiding in debugging and security auditing. This approach aligns with industry standards such as CWE-126 Buffer Over-read and CWE-20 Improper Input Validation, ensuring that external inputs are rigorously checked against expected constraints before processing. The fix also reflects best practices outlined in the MITRE ATT&CK framework regarding initial access techniques involving hardware manipulation or firmware exploitation, emphasizing the need for robust input validation at all layers of system initialization to prevent exploitation through malformed device descriptors.