CVE-2026-46190: mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's SPI NOR flash debugfs subsystem, specifically in the spi_nor_params_show() function. An attacker with a low-privilege local account can trigger the flaw by causing flag-bit evaluation to walk past the end of the snor_f_names pointer array, which is incorrectly sized using sizeof() instead of ARRAY_SIZE(). Successful exploitation allows the attacker to read arbitrary kernel memory and disrupt the affected kernel subsystem. Patched-image rebuilds at fix versions 6.6.140, 6.12.88, and 6.18.30 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required to trigger the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or root-level credentials to reach the debugfs interface.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the out-of-bounds read directly without social engineering or victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory-layout luck, or other environmental factors.

Blast Radius

• Reads kernel memory contents beyond the intended array boundary, which may expose internal kernel pointers, flag values, or adjacent data structures.
• Crashes or destabilizes the SPI NOR debugfs subsystem, causing denial-of-service for processes or tools that rely on that kernel interface.
• On 64-bit systems the effective over-read window is up to 8x the intended array size, widening the range of potentially exposed kernel memory.