CVE-2026-89952

In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: validate ONFI extended parameter page sections

nand_flash_detect_ext_param_page() allocates the length declared by the

ONFI parameter page, then treats the data as a fixed header followed by

variable-length sections. It reads that header and advances over sections

without first proving that the fixed page and each current section fit in

the allocation.

Reject pages shorter than the fixed header, track the remaining variable

area while walking sections, and require the ECC section to contain every

field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics

that identify the malformed ONFI section.