The Linux kernel's flash memory driver, spi-nor, contains an out-of-bounds read bug in spi_nor_params_show(). The function mistakes the size of an array of pointers for the number of elements by using sizeof on the pointer array, which on 64-bit systems inflates the length eight times. This miscalculation is used by spi_nor_print_flags() to bounds-check array accesses, allowing a flag that exceeds the real element count but falls within the inflated byte size to trigger a read beyond the array boundary. The exposed data can include sensitive kernel memory, resulting in information disclosure. The weakness corresponds to CWE-125 (Out-of-bounds Read) and CWE-788 (Read or Write of Invalid Memory Location).

All Linux kernel versions that contain the debugfs spi-nor implementation are affected until the fix is applied. The issue is present in the source tree for the Linux kernel as a whole, with no version restrictions listed. System administrators should consider any kernel running the buggy code as susceptible.

The vulnerability has a CVSS score of 7.1, EPSS < 1%, and is not listed in the CISA KEV catalog. While the description does not explicitly state an exploitation path, the code path involves debugfs, so the likely attack vector is local access to debugfs, which is typically available only to users with root privileges or those granted debugfs permissions. Thus the attack surface is local and requires elevated or privileged user access. An attacker who can read the out-of-bounds data might use the information disclosure to facilitate further local privilege escalation or sensitive data extraction; no remote exploitation path is described.