AIKIDO-2026-663165

TL;DR

The SF32LB MPI QSPI NOR flash driver validates read and write offsets with a check that adds a signed offset to an unsigned size, so a negative offset wraps to a large value and can pass the bound. Under CONFIG_USERSPACE the flash_read and flash_write syscalls delegate offset checking to the driver, so an unprivileged thread granted the flash device can supply a crafted negative offset. The read path then copies memory outside the mapped flash window into the caller buffer, disclosing unauthorized memory, and the write path programs flash and invalidates cache at an out-of-range address. The fix validates the range with overflow-safe 64-bit arithmetic and rejects negative offsets on both paths.