{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "b7cf5e2830bbb128699d7635ce8404b7f605bc95"
            },
            {
              "fixed": "1bec05a68414cf8d0cab6cb42445b8603f32ffc4"
            },
            {
              "fixed": "3ad8ff12fd44b08af9212ac4883a7e29d2ab7348"
            },
            {
              "fixed": "875daa3c750814ff2e2dc050239c390048f0bcd0"
            },
            {
              "fixed": "da740539e8f370767317e24615349b9342a6e773"
            },
            {
              "fixed": "1edea8900ca3e405c1421d8b5c29f97107874f72"
            },
            {
              "fixed": "18916f475057cbd2fb8ea6ae86e6b85884ad1d53"
            },
            {
              "fixed": "d14e6298139f58a87a87d7022e26a7f37f0ddce7"
            },
            {
              "fixed": "e9290031f736e99ad17c25c00311c92c266843b7"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.10.270"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.221"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.188"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.110"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.51"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89954.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: afs: validate v2 image info bounds\n\nThe AFS v2 parser uses footer[8] to locate the image information block\ninside the current erase block, then uses the image information\nregion_count to walk entries from a fixed local array. The footer offset\nand region count come from flash contents and are not checked against the\nerase block or the local image-info array before use.\n\nReject v2 entries whose image information offset would underflow the\nerase block calculation, and reject region counts that cannot fit in the\nlocal image-info array before walking region entries.",
  "id": "CVE-2026-89954",
  "modified": "2026-09-18T03:30:36.704663438Z",
  "published": "2026-09-16T10:32:38.355Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/18916f475057cbd2fb8ea6ae86e6b85884ad1d53"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1bec05a68414cf8d0cab6cb42445b8603f32ffc4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1edea8900ca3e405c1421d8b5c29f97107874f72"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3ad8ff12fd44b08af9212ac4883a7e29d2ab7348"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/875daa3c750814ff2e2dc050239c390048f0bcd0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d14e6298139f58a87a87d7022e26a7f37f0ddce7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/da740539e8f370767317e24615349b9342a6e773"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e9290031f736e99ad17c25c00311c92c266843b7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89954.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89954"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mtd: afs: validate v2 image info bounds"
}