CVE-2026-11743

Name of the Vulnerable Software and Affected Versions SF32LB MPI QSPI NOR flash driver (affected versions not specified)

Description The SF32LB MPI QSPI NOR flash driver in drivers/flash/flash sf32lb mpi qspi nor.c contains an integer signedness error in its read and write paths. The driver validates the flash offset and length using the test (offset + size) > data->size. Since offset is a signed off t and size is unsigned, a negative offset can cause the addition to wrap around to a small value, bypassing the bounds check. This allows access to memory outside the mapped flash window via memcpy() in the read path and through programming and cache-invalidation in the write path.

In configurations with CONFIG USERSPACE, the flash read and flash write syscalls delegate offset bounds checking to the driver. An unprivileged thread with access to the flash device can use a crafted negative offset to copy arbitrary CPU-addressable memory into its own buffer, leading to unauthorized information disclosure. Additionally, the write path can be used to program flash at out-of-range addresses and invalidate arbitrary cache ranges, impacting system integrity and availability.

Recommendations Update the driver to replace the existing bounds check with the qspi nor range is valid() function to ensure negative offsets are rejected and comparisons are performed using overflow-safe 64-bit arithmetic. Implement an SRAM DMA bounce buffer and source/destination overlap rejection to prevent DMA bus-hang conditions.