CVE-2026-46190

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1

Description An out-of-bounds read exists in the spi nor params show() function within the spi-nor debugfs component. The issue occurs because the snor f names array is passed to the spi nor print flags() function using sizeof(), which returns the total byte size of the pointer array rather than the number of elements. On 64-bit systems, this results in a length eight times larger than intended. If a flag bit is set that exceeds the actual element count but falls within the inflated byte-size count, the names len argument fails to properly bounds-check the names array access, leading to an out-of-bounds read.

Recommendations Update to a version where ARRAY SIZE() is used instead of sizeof() to pass the actual number of string pointers in the array. Update to kernel-devel-7.0.11-1.1 or a newer version.