---
id: CVE-2026-89954
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: afs: validate v2 image info bounds

  The AFS v2 parser uses footer[8] to locate the image information block
  inside the current erase block, then uses the image info…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: afs: validate v2 image info bounds

  The AFS v2 parser uses footer[8] to locate the image information block
  inside the current erase block, then uses the image info…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b7cf5e2830bbb128699d7635ce8404b7f605bc95 <
    1bec05a68414cf8d0cab6cb42445b8603f32ffc4
  - >-
    Linux >= b7cf5e2830bbb128699d7635ce8404b7f605bc95 <
    3ad8ff12fd44b08af9212ac4883a7e29d2ab7348
  - >-
    Linux >= b7cf5e2830bbb128699d7635ce8404b7f605bc95 <
    875daa3c750814ff2e2dc050239c390048f0bcd0
  - >-
    Linux >= b7cf5e2830bbb128699d7635ce8404b7f605bc95 <
    da740539e8f370767317e24615349b9342a6e773
  - >-
    Linux >= b7cf5e2830bbb128699d7635ce8404b7f605bc95 <
    1edea8900ca3e405c1421d8b5c29f97107874f72
  - >-
    Linux >= b7cf5e2830bbb128699d7635ce8404b7f605bc95 <
    18916f475057cbd2fb8ea6ae86e6b85884ad1d53
  - >-
    Linux >= b7cf5e2830bbb128699d7635ce8404b7f605bc95 <
    d14e6298139f58a87a87d7022e26a7f37f0ddce7
  - >-
    Linux >= b7cf5e2830bbb128699d7635ce8404b7f605bc95 <
    e9290031f736e99ad17c25c00311c92c266843b7
  - Linux 5.2
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:20.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89954'
references:
  - url: 'https://git.kernel.org/stable/c/18916f475057cbd2fb8ea6ae86e6b85884ad1d53'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1bec05a68414cf8d0cab6cb42445b8603f32ffc4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1edea8900ca3e405c1421d8b5c29f97107874f72'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3ad8ff12fd44b08af9212ac4883a7e29d2ab7348'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/875daa3c750814ff2e2dc050239c390048f0bcd0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d14e6298139f58a87a87d7022e26a7f37f0ddce7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/da740539e8f370767317e24615349b9342a6e773'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e9290031f736e99ad17c25c00311c92c266843b7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.962Z'
epss: 0.0019
epssPercentile: 0.07686
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mtd: afs: validate v2 image info bounds

The AFS v2 parser uses footer[8] to locate the image information block
inside the current erase block, then uses the image information
region_count to walk entries from a fixed local array. The footer offset
and region count come from flash contents and are not checked against the
erase block or the local image-info array before use.

Reject v2 entries whose image information offset would underflow the
erase block calculation, and reject region counts that cannot fit in the
local image-info array before walking region entries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.