---
id: CVE-2026-89952
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: rawnand: validate ONFI extended parameter page sections

  nand_flash_detect_ext_param_page() allocates the length declared by the
  ONFI parameter page, then treats t…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: rawnand: validate ONFI extended parameter page sections

  nand_flash_detect_ext_param_page() allocates the length declared by the
  ONFI parameter page, then treats t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a <
    1bf148fabe6463422195b7cc43b3412533f1dc21
  - >-
    Linux >= 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a <
    c7df90bbda71549bfd981bf478ad04ddfccf4e0d
  - >-
    Linux >= 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a <
    86948f81964e40cd6472d76a6371e4f297d84db0
  - >-
    Linux >= 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a <
    ddb6ddf5be7429bb98b3368c883be51f00b31678
  - >-
    Linux >= 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a <
    12a63a0f0d17b2d26211b2524ded91a67dd5c99c
  - >-
    Linux >= 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a <
    c8f86e375b39cada09fd8cb33dd3bb3641e84a62
  - >-
    Linux >= 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a <
    23e747fe585830c43095c37c85b2757231c6917f
  - >-
    Linux >= 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a <
    e5e415262330bd70f983e091d8919d9dcd99e475
  - Linux 3.12
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:17:05.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89952'
references:
  - url: 'https://git.kernel.org/stable/c/12a63a0f0d17b2d26211b2524ded91a67dd5c99c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1bf148fabe6463422195b7cc43b3412533f1dc21'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/23e747fe585830c43095c37c85b2757231c6917f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/86948f81964e40cd6472d76a6371e4f297d84db0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c7df90bbda71549bfd981bf478ad04ddfccf4e0d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c8f86e375b39cada09fd8cb33dd3bb3641e84a62'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ddb6ddf5be7429bb98b3368c883be51f00b31678'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e5e415262330bd70f983e091d8919d9dcd99e475'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.962Z'
epss: 0.00211
epssPercentile: 0.11608
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: validate ONFI extended parameter page sections

nand_flash_detect_ext_param_page() allocates the length declared by the
ONFI parameter page, then treats the data as a fixed header followed by
variable-length sections. It reads that header and advances over sections
without first proving that the fixed page and each current section fit in
the allocation.

Reject pages shorter than the fixed header, track the remaining variable
area while walking sections, and require the ECC section to contain every
field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics
that identify the malformed ONFI section.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.