CVE-2026-89954

The AFS (Arm Firmware Suite) v2 partition parser in the Linux kernel MTD subsystem fails to validate values read from flash before using them: the footer-derived image information offset is not checked against the current erase block (allowing an underflow in the erase block calculation), and the flash-supplied region_count is not checked against a fixed-size local array before region entries are walked. An attacker who can control or corrupt the contents of AFS-partitioned flash — for example via a crafted firmware image or malicious local access to the flash device — can trigger out-of-bounds memory accesses in the kernel. Successful exploitation can lead to kernel information disclosure, denial of service, and potentially privilege escalation (CVSS 8.0: local vector, no privileges or user interaction required). Any Linux system running a kernel with the AFS v2 parser enabled on hardware using AFS flash partition layouts is affected, which in practice means a small set of embedded ARM platforms. No public proof-of-concept or in-the-wild exploitation is known.

What to do: Update to a kernel that includes the upstream fix for CVE-2026-89954, or backport the AFS v2 bounds-validation patch into your vendor kernel. Check whether your devices enable CONFIG_MTD_AFS and actually use AFS flash partitioning; if not patched, limit local access to MTD character/block devices and avoid loading firmware images from untrusted sources onto AFS-partitioned flash.