CVE-2026-46190

A flaw was found in the Linux kernel's Memory Technology Device (MTD) SPI-NOR debugfs component. An out-of-bounds read vulnerability exists in the spi_nor_params_show() function due to an incorrect calculation of an array's size. This error allows a local attacker to read memory outside of the intended buffer, which could lead to information disclosure or system instability.

Red Hat has rated this issue as having a Moderate impact because exploiting it requires local system access to debugfs entries, which are restricted to administrative users by default on Red Hat Enterprise Linux. An attacker with access to the debugfs interface for SPI-NOR devices could trigger an invalid memory access, potentially resulting in system instability or kernel memory leakage. Earlier releases, such as Red Hat Enterprise Linux 8 and 9, do not incorporate the vulnerable code and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.