CVE-2026-89954
Received
Received - Intake
BaseFortify
Vulnerability report for CVE-2026-89954, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-16
Last updated on: 2026-09-16
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
mtd: afs: validate v2 image info bounds
The AFS v2 parser uses footer[8] to locate the image information block
inside the current erase block, then uses the image information
region_count to walk entries from a fixed local array. The footer offset
and region count come from flash contents and are not checked against the
erase block or the local image-info array before use.
Reject v2 entries whose image information offset would underflow the
erase block calculation, and reject region counts that cannot fit in the
local image-info array before walking region entries.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | b7cf5e2830bbb128699d7635ce8404b7f605bc95 |
| Linux | Linux | b7cf5e2830bbb128699d7635ce8404b7f605bc95 |
| Linux | Linux | b7cf5e2830bbb128699d7635ce8404b7f605bc95 |
| Linux | Linux | b7cf5e2830bbb128699d7635ce8404b7f605bc95 |
| Linux | Linux | b7cf5e2830bbb128699d7635ce8404b7f605bc95 |
| Linux | Linux | b7cf5e2830bbb128699d7635ce8404b7f605bc95 |
| Linux | Linux | b7cf5e2830bbb128699d7635ce8404b7f605bc95 |
| Linux | Linux | b7cf5e2830bbb128699d7635ce8404b7f605bc95 |
| Linux | Linux | 5.2 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
