CVE-2026-46190 Linux CVE debrief

Who should care

Linux system administrators, embedded device manufacturers using SPI NOR flash, and security teams monitoring kernel vulnerabilities

Technical summary

The spi_nor_params_show() function in the Linux kernel's MTD SPI NOR driver incorrectly uses sizeof() on an array of string pointers when calling spi_nor_print_flags(). On 64-bit systems, this causes the bounds check to use 8 times the actual element count, permitting out-of-bounds reads when flag bits exceed the true array size but remain within the inflated byte count. The fix replaces sizeof() with ARRAY_SIZE() to pass the correct element count.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates from your Linux distribution that include the fix for CVE-2026-46190
• Verify that debugfs is mounted with restrictive permissions or disabled if not required for production systems
• Monitor kernel logs for any unusual debugfs access patterns
• Review local access controls to limit exposure of debugfs interfaces

Evidence notes

The vulnerability was identified by Sashiko and reported via the Linux kernel mailing list. The fix has been committed to multiple stable kernel branches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.