CVE-2026-89954

In the Linux kernel, the following vulnerability has been resolved:

mtd: afs: validate v2 image info bounds

The AFS v2 parser uses footer[8] to locate the image information block

inside the current erase block, then uses the image information

region_count to walk entries from a fixed local array. The footer offset

and region count come from flash contents and are not checked against the

erase block or the local image-info array before use.

Reject v2 entries whose image information offset would underflow the

erase block calculation, and reject region counts that cannot fit in the

local image-info array before walking region entries.