EUVD-2026-80554
GHSA-jx3v-9v24-f367
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Untrusted input is flash contents requiring raw-flash write or physical access (PR:H, AV:L); deterministic once crafted (AC:L); bounded OOB read gives C:L/I:L, kernel crash gives A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mtd: afs: validate v2 image info bounds
The AFS v2 parser uses footer[8] to locate the image information block inside the current erase block, then uses the image information region_count to walk entries from a fixed local array. The footer offset and region count come from flash contents and are not checked against the erase block or the local image-info array before use.
Reject v2 entries whose image information offset would underflow the erase block calculation, and reject region counts that cannot fit in the local image-info array before walking region entries.
AnalysisAI
Out-of-bounds access in the Linux kernel MTD AFS (ARM Flash Structure) v2 partition parser lets crafted flash contents drive the image-information offset and region count beyond the bounds of the local image-info array, producing a kernel memory-safety fault during partition scanning. The code path is only reachable on platforms that enable and scan AFS v2 partitions, and per the independent assessment exploitation requires a local actor with high privileges (PR:H) - root or CAP_SYS_ADMIN write access to the raw MTD device, or physical replacement/tampering of the flash chip - with the malicious data consumed when the kernel parses the partition table at boot or device attach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an ARM system using the MTD ARM Flash Filesystem (AFS) v2 partition type, and the attacker must be able to control the flash contents that the AFS v2 parser reads - specifically the footer[8] image-info offset and the region_count. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic high-CVSS-but-low-real-risk kernel parsing flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to the fixed stable kernel for your branch - 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, or 7.2.5, with mainline 7.3-rc1 containing the fix; the corresponding upstream patches are the kernel.org stable commits b7cf5e2830bbb128699d7635ce8404b7f605bc95 through the per-branch commit IDs listed in the references (e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify which Linux-based embedded, ARM, or OT systems in the fleet build and scan MTD AFS v2 partitions, and confirm on a sample of devices whether the kernel exposes raw MTD devices to non-root or container workloads; restrict raw MTD device access to a minimal set of trusted privileged roles and log any unexpected use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today