The Linux kernel's mtd spi-nor debugfs interface contained an out-of-bounds read vulnerability in spi_nor_params_show(). The function passed the snor_f_names array length using sizeof(snor_f_names), which returns the total byte size of the pointer array rather than the element count. On 64-bit systems, this results in a length value 8 times larger than the actual number of elements. Consequently, spi_nor_print_flags() may read beyond the array bounds if a flag bit exceeds the actual element count but is within the inflated byte-size count. The vulnerability was corrected by replacing sizeof() with ARRAY_SIZE() to pass the correct element count.

This vulnerability allows an out-of-bounds read in kernel memory, which can lead to information disclosure (confidentiality impact) and potentially cause a denial of service (availability impact). The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

A fix is available and has been applied in Linux kernel versions 7.0.0-28.28.1 and later. Users should update to these or newer kernel versions to remediate the vulnerability. Since this is a kernel-level issue, applying the official kernel update from the vendor is the recommended mitigation.