CVE-2026-89952 mtd: rawnand: validate ONFI extended parameter page sections
A missing bounds check in the Linux kernel NAND driver allows attackers with physical access to trigger memory corruption via malformed ONFI parameter pages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89952?
CVE-2026-89952 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: validate ONFI extended parameter page sections
nand_flash_detect_ext_param_page() allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It reads that header and advances over sections without first proving that the fixed page and each current section fit in the allocation.
Reject pages shorter than the fixed header, track the remaining variable area while walking sections, and require the ECC section to contain every field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics that identify the malformed ONFI section.
Which versions are affected by CVE-2026-89952?
How do I fix CVE-2026-89952?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89952 being exploited?
There is no known exploitation of CVE-2026-89952 in the wild and no public exploit code.
Sources
Also known as AZL-101228, BELL-CVE-2026-89952, DEBIAN-CVE-2026-89952, GHSA-xvpp-cjh2-87mx, UBUNTU-CVE-2026-89952.