AZL-101228 CVE-2026-89952 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

CVE-2026-89952

CVE-2026-89952 affects the Linux kernel's mtd: rawnand subsystem , specifically the nand_flash_detect_ext_param_page() function. The root cause is an insufficient bounds check: the function allocates memory based on the length declared in the ONFI parameter page, then reads a fixed header and wal...

CVE-2026-89952 mtd: rawnand: validate ONFI extended parameter page sections

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

EUVD-2026-80552

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

Linux Distros Unpatched Vulnerability : CVE-2026-89952

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fslupm: A bug in the funexecop function was fixed; a “off-by-one” test was corrected. The “op-cs” values are copied into “fun-mchipnumber”, which is used to access the “mchipoffsets” and “rnbgpio” arrays. These arra...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: Serialize lock/unlock operations in relation to other NAND operations. The functions nandlock and nandunlock involve calling chip-ops.lockarea/unlockarea, but they do not hold the NAND device lock. In controllers th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: denali: Use managed device resources All resources used by this driver have managed interfaces; therefore, use them. Otherwise, we will encounter the following error: 4.472703 denali-nand-pci 0000:00:05.0: Timeout...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: intel: A possible null-ptr-deref issue in ebunandprobe has been fixed. This issue could lead to a null-ptr-deref when using ‘res’. If platformgetresource returns NULL, moving using ‘res’ after devmioremapresource wi...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: gpmi: do not leak PM reference in the error path. If gpminfcapplytimings fails, the PM runtime usage counter must be dropped...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mtd: rawnand: brcmnand: fixed the PM resume warning The warning during PM resume was fixed as shown below, due to an uninitialized struct nandoperation that checks the chip select field: WARNONop-cs = nanddevntargets&chip-base...

CVE-2026-72165

A flaw was found in the mtd: rawnand component of the Linux kernel. The nandselecttarget function contains an incorrect condition check for the 'cs' chip select parameter, allowing it to go out of its intended range. This out-of-bounds access could potentially lead to a system crash, resulting in...

CVE-2026-72167

A flaw was found in the mtd: rawnand: pl353 component of the Linux kernel. During the probe function, the devmioremap call incorrectly uses the parent device instead of the pl35x device for resource allocation. This oversight prevents the register area from being properly released when the module...

Linux Distros Unpatched Vulnerability : CVE-2026-72165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets. CVE-2026-72165 Note that Nessus relies on the presence of the...

CVE-2026-72167

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

CVE-2026-72165

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-72167

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

UBUNTU-CVE-2026-72165

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-72165

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-68466

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...