CVE-2026-11743

This vulnerability is fundamentally an architectural trust-boundary failure, not merely a signedness bug. The key detail the CVE doesn't emphasize: the driver's erase path already validated offsets correctly — rejecting negative values outright — while read and write paths did not. In a single 300-line file, one function enforced the security contract and two adjacent functions didn't. That inconsistency is the real story. The fix introduces a `qspi_nor_range_is_valid()` helper rather than patching inline checks, which strongly suggests this validation existed for erase and was retrofitted to the other paths only after the vulnerability was found. This means the knowledge that the check was necessary existed in the codebase but wasn't propagated across code paths maintained by the same team. The syscall design deliberately defers offset bounds-checking to the driver, treating the flash driver as a security boundary. But the driver only partially enforces that boundary — erase checks, read and write don't. An unprivileged thread with access to the flash device object can exploit this gap without privilege escalation, which makes the severity understated for environments where device grants are managed loosely. Watch the DMA bounce buffer addition in the fix. It wasn't in the original CVE description, yet the developer added it alongside the signedness fix. This indicates a second, separately exploitable failure mode — likely a DMA bus-hang condition on certain memory alignments that can be triggered from userspace without special privilege. The CVE captures one failure mode (memory disclosure via negative offset), but the fix addresses two. That mismatch between disclosed and actual vulnerability scope should inform your patching priority. For remediation: check whether other flash drivers in your tree share the same `base + offset` memcpy pattern without equivalent validation — the pattern likely recurs. If your build enables CONFIG_USERSPACE, verify the device grant model in your OS configuration, because the attack surface disappears on non-userspace builds. The signedness mismatch between `off_t` (signed) and size (unsigned) is the technical mechanism, but the architectural inconsistency is what made it persist.

Reviewed through automated stages and approved by a human before publication.