CVE-2026-46190: Linux Kernel SPI-NOR Debugfs Out-of-Bounds Read Vulnerability

Technical summary

CVE-2026-46190 is an out-of-bounds read vulnerability in the Linux kernel's MTD/SPI-NOR subsystem, specifically within the spi_nor_params_show() debugfs handler. The flaw stems from passing sizeof(snor_f_names) to spi_nor_print_flags() instead of the array's element count via ARRAY_SIZE(). Since snor_f_names is an array of pointers, sizeof() returns the total bytes (element_count * sizeof(void*)), which on 64-bit systems inflates the length by a factor of 8. The inflated bounds-check value permits out-of-bounds array access when flag bits correspond to indices within the byte-size but beyond the actual element count, violating CWE-125 (out-of-bounds read).

Business impact

This vulnerability affects the availability and confidentiality of Linux systems. Local attackers can trigger a kernel panic, disrupting services running on affected systems. Additionally, the out-of-bounds read may expose kernel memory contents, potentially revealing security-sensitive data or information useful for further exploitation. Systems with SPI-NOR flash devices and debugfs enabled are at risk, though the attack requires local access and unprivileged execution capability. Managed service providers, embedded Linux deployments, and multi-tenant environments face the greatest operational risk.

Affected systems

The Linux kernel is affected. Vulnerability requires debugfs to be mounted and accessible (common in development and some production environments). Impact is primarily on systems using SPI-NOR flash memory devices, including ARM-based embedded systems, IoT devices, and platforms with external NOR flash storage. The vulnerability applies to all Linux kernel versions containing the vulnerable spi_nor_params_show() code; specific affected versions should be verified against the kernel security advisories and your kernel's release notes.

Exploitability

Exploitation requires local access and unprivileged user privileges to read from debugfs (typically mounted at /sys/kernel/debug). No network access is required. The attack is reliable and deterministic—an attacker simply needs to read the vulnerable debugfs file with a flag value that triggers the out-of-bounds condition. The barrier to exploitation is low, though practical impact depends on system configuration and whether debugfs is exposed to untrusted users. No known public exploits have been disclosed, but the vulnerability is straightforward to weaponize.

Remediation

Patch the Linux kernel using ARRAY_SIZE() instead of sizeof() when passing the snor_f_names array to spi_nor_print_flags(). This ensures the correct element count is used for bounds-checking. Administrators should apply kernel updates from their distribution or Linux.org when available. As an interim mitigation, restrict debugfs access by ensuring /sys/kernel/debug is not world-readable and is accessible only to trusted administrators (e.g., via kernel.debugfs_restrict_access or mount options). Consider disabling debugfs entirely on production systems that do not require it.

Patch guidance

Monitor your Linux distribution's security advisories for a patched kernel version addressing this MTD/SPI-NOR debugfs issue. Apply patches during a scheduled maintenance window with appropriate system reboot planning. Verify the patch includes the ARRAY_SIZE() correction in the spi_nor_params_show() function. Test patched kernels in a non-production environment first to confirm compatibility with your hardware and workloads. Kernel versions will vary by distribution; consult your vendor's advisory for specific version numbers and timelines.

Detection guidance

Monitor system logs (dmesg, kernel.log) for kernel panics or out-of-bounds access warnings that may indicate exploitation attempts. Audit debugfs mount points and file permissions to identify overly permissive configurations. If debugfs is mounted, verify access controls restrict it to root and authorized personnel. Monitor local process execution for suspicious reads of /sys/kernel/debug/spi_nor_params or similar MTD debugfs files from unprivileged users. Kernel Address Sanitizer (KASAN) or similar debugging tools, if enabled, will detect and report the out-of-bounds read at runtime.

Why prioritize this

Although CVE-2026-46190 requires local access and is not remotely exploitable, its CVSS 7.1 HIGH severity reflects the combination of achievable denial-of-service impact and potential information disclosure. The low complexity and unprivileged attack vector, coupled with realistic multi-user and containerized deployment scenarios, make this a meaningful risk for most organizations. Prioritize patching for systems where debugfs is exposed, shared hosting environments, and embedded/IoT infrastructure where local threat actors are more likely. Production servers in isolated environments may be lower priority if debugfs access is properly restricted.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: (1) Local attack vector requiring physical or credential-based system access; (2) Low attack complexity with no special conditions needed once local access is obtained; (3) Low privilege requirement—unprivileged users can trigger the flaw via debugfs; (4) High confidentiality impact from potential kernel memory exposure; (5) High availability impact from kernel panic/crash; (6) No integrity impact since the flaw is read-only. The score appropriately prioritizes this above low-impact vulnerabilities but below remote code execution or remote denial-of-service flaws.

Frequently asked questions