CVE-2026-89952: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89952 Overview

CVE-2026-89952 is a Linux kernel vulnerability in the MTD raw NAND subsystem. The flaw affects nand_flash_detect_ext_param_page(), which parses the Open NAND Flash Interface (ONFI) extended parameter page. The function allocates a buffer using the length declared by the parameter page, then walks a fixed header followed by variable-length sections without first validating that the header and each section actually fit inside the allocation. A malformed or malicious ONFI parameter page can therefore cause the parser to read past the allocated buffer.

Critical Impact
Insufficient bounds validation in the ONFI extended parameter page parser can lead to out-of-bounds reads in kernel memory when a NAND device presents a crafted parameter page.

Affected Products

Linux kernel mtd/rawnand subsystem
Systems using raw NAND flash devices exposing ONFI extended parameter pages
Downstream distributions shipping affected kernel versions prior to the fix

Discovery Timeline

2026-09-16 - CVE-2026-89952 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89952

Vulnerability Analysis

The nand_flash_detect_ext_param_page() function in the Linux kernel raw NAND driver processes the ONFI extended parameter page returned by a NAND device. The parser allocates a buffer of the size the device advertises, then treats the contents as a fixed header followed by a sequence of variable-length sections. It advances through those sections and dereferences fields such as struct onfi_ext_ecc_info without confirming that the declared layout fits within the allocation.

When a device returns a parameter page shorter than the fixed header, or declares sections that extend past the buffer, the parser reads memory outside the intended structure. This is an out-of-bounds read [CWE-125] in kernel context, driven by attacker-controlled length fields inside the ONFI payload.

Root Cause

The root cause is missing length validation. The parser trusts the ONFI-declared sizes and does not verify that (1) the allocation is at least large enough to contain the fixed header, (2) each section header lies fully within the remaining buffer, and (3) the ECC section contains every field referenced from struct onfi_ext_ecc_info before those fields are read.

Attack Vector

Exploitation requires a NAND device, or an emulated NAND controller path, that can return a crafted ONFI extended parameter page during probe. The attack surface is therefore local and hardware-adjacent: malicious or tampered flash media, compromised firmware on a removable NAND module, or a virtualized guest that can influence NAND probe data. There is no known remote network vector. See the upstream fixes for the exact validation added, including kernel commit 12a63a0 and kernel commit e5e4152.

// No verified proof-of-concept code is published for CVE-2026-89952.
// The vulnerable pattern, in prose: nand_flash_detect_ext_param_page()
// allocated len bytes based on the ONFI-declared page length, cast the
// buffer to a fixed header, then iterated section descriptors and read
// onfi_ext_ecc_info fields without verifying that header_size and each
// section offset+length remained within len.

Detection Methods for CVE-2026-89952

Indicators of Compromise

Kernel log messages from the raw NAND driver reporting malformed or rejected ONFI sections after patch adoption.
Repeated NAND probe failures on systems that previously enumerated flash devices without error.
Unexpected kernel warnings, KASAN reports, or oopses originating in nand_flash_detect_ext_param_page() or nearby MTD functions.

Detection Strategies

Inventory kernel versions across Linux endpoints and embedded devices, and flag hosts running raw NAND kernels earlier than the fix commits referenced by the CVE.
Enable KASAN in test and QA kernels to surface out-of-bounds reads during NAND probe against untrusted media.
Correlate dmesg entries mentioning onfi, ext_param, or ecc_info with device insertion events for tampered-media investigation.

Monitoring Recommendations

Forward kernel logs from Linux fleet and embedded gateways to a central log platform and alert on MTD or NAND parser errors.
Track probe-time failures on IoT and industrial devices that consume removable NAND, as those are the most likely exploitation surface.
Monitor package and kernel update status to confirm patched builds are actually running after reboot.

How to Mitigate CVE-2026-89952

Immediate Actions Required

Apply the vendor kernel update that includes the ONFI extended parameter page validation fix on all affected hosts and devices.
Prioritize systems that accept removable or field-replaceable NAND media, since those expose the parser to untrusted input.
Reboot into the patched kernel and confirm the running version, since the raw NAND probe runs early in boot.

Patch Information

The fix rejects parameter pages shorter than the fixed header, tracks the remaining variable area while iterating sections, and requires the ECC section to contain every field read from struct onfi_ext_ecc_info. Diagnostics are device-scoped so the malformed ONFI section can be identified. Backports are available across stable branches, including kernel commit 1bf148f, kernel commit 23e747f, kernel commit 86948f8, kernel commit c7df90b, kernel commit c8f86e3, and kernel commit ddb6ddf.

Workarounds

Where patching is not immediately possible, restrict physical access to NAND slots and treat removable flash media as untrusted.
Disable or unbind the raw NAND driver on systems that do not require it, reducing exposure to the vulnerable probe path.
For embedded product lines, gate firmware updates on the presence of the fix commits before shipping images to the field.

bash

# Verify the running kernel and confirm the patched version is active
uname -r

# Check whether the raw NAND driver is loaded on a host that does not need it
lsmod | grep -Ei 'nand|mtd'

# Unbind the raw NAND driver where NAND flash is not required
# (Substitute the actual module name in use on the platform)
# modprobe -r <nand_driver_module>