Look up another CVE · open CVE-2026-89954 in the interactive tracker
CVE-2026-89954
mtd: afs: validate v2 image info bounds
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/mtd. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-89954 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The AFS v2 parser uses footer[8] to locate the image information block inside the current erase block, then uses the image information region_count to walk entries from a fixed local array. The footer offset and region count come from flash contents and are not checked against the erase block or the local image-info array before use. Reject v2 entries whose image information offset would underflow the erase block calculation, and reject region counts that cannot fit in the local image-info array before walking region entries.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/mtd/parsers/afs.c
- What this is
- MEMORY TECHNOLOGY DEVICES (MTD)MAINTAINERS section matched on drivers/mtd/ · linux-mtd@lists.infradead.org · Maintained
- Kernel module
- none to look for. The file would have gone into afs, and Debian does not compile it into that module, so finding afs in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_MTD|CONFIG_MTD_AFS_PARTS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_MTD, CONFIG_MTD_AFS_PARTS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 8.0 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/mtd
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.2 | 5.10.270 | 1bec05a68414 |
| 5.2 | 5.15.221 | 3ad8ff12fd44 |
| 5.2 | 6.1.188 | 875daa3c7508 |
| 5.2 | 6.6.157 | da740539e8f3 |
| 5.2 | 6.12.110 | 1edea8900ca3 |
| 5.2 | 6.18.51 | 18916f475057 |
| 5.2 | 7.2.5 | d14e6298139f |
| 5.2 | 7.3 | e9290031f736 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The AFS v2 parser runs from parse_mtd_partitions() during local MTD/physmap probe, reading on-flash ARM Firmware Suite footers via mtd_read(); no network protocol, Bluetooth/Wi-Fi path, or USB gadget/host handler invokes this code.
- AC:LAttack complexity, low
- An attacker who controls the flash image can plant valid AFS v2 magic and CRC and set footer[8] and region_count arbitrarily, so the unsigned info-block offset and the region walk run deterministically with no race or layout condition outside attacker control.
- PR:NPrivileges required, none
- parse_afs_partitions() runs automatically at boot/probe on affected ARM/physmap systems with no credential or capability check; crafted AFS metadata can be delivered in firmware/OTA/supply-chain flash contents without a local OS account.
- UI:NUser interaction, none
- Partition parsing runs as part of MTD driver initialization at boot or bind; no separate victim action such as mounting a filesystem or opening a device node is required.
- S:UScope, unchanged
- The stack over-read and any resulting oops remain inside the host kernel; this is not a VM escape, IOMMU bypass, or sandbox breakout.
- C:HConfidentiality impact, high
- Attacker-controlled region_count drives an unbounded read past the on-stack imginfo[36] array, and kstrdup() of a possibly non-NUL-terminated footer name can copy that kernel stack/adjacent memory into a partition name far beyond a small bounded leak.
- I:LIntegrity impact, low
- OOB-derived region offset/size and repeated kstrdup() results are stored in the registered mtd_partition object, modifying kernel flash-layout metadata, but the loop does not perform an out-of-bounds write or yield a control-flow hijack primitive.
- A:HAvailability impact, high
- Walking region_count past imginfo[] reaches unmapped stack or vmalloc pages and oopses or panics the kernel; a huge count can also livelock probe and exhaust memory via kstrdup in the loop.