A vulnerability was found in Linux Kernel, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead. Reference: https://github.com/torvalds/linux/commit/193e87143c290ec16838f5368adc0e0bc94eb931 https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=193e87143c290ec16838f5368adc0e0bc94eb931
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1735634]
This was fixed for Fedora in 4.9.6 and never impacted any currently supported Fedora releases.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2016-10764