CVE-2026-46190

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()

Sashiko noticed an out-of-bounds read [1].

In spi_nor_params_show(), the snor_f_names array is passed to

spi_nor_print_flags() using sizeof(snor_f_names).

Since snor_f_names is an array of pointers, sizeof() returns the total

number of bytes occupied by the pointers

(element_count * sizeof(void *))

rather than the element count itself. On 64-bit systems, this makes the

passed length 8x larger than intended.

Inside spi_nor_print_flags(), the 'names_len' argument is used to

bounds-check the 'names' array access. An out-of-bounds read occurs

if a flag bit is set that exceeds the array's actual element count

but is within the inflated byte-size count.

Correct this by using ARRAY_SIZE() to pass the actual number of

string pointers in the array.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References