net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74694
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 16:16:43 UTC
Updated2026-08-22 16:16:43 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length ncsi_send_cmd_nl() takes the number of bytes to copy from the attacker-controlled ncsi_pkt_hdr.length field of the in-band packet header, while the source buffer is the NCSI_ATTR_DATA netlink attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr). The two length sources are never cross-checked: only nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced. With hdr->length set larger than the attribute payload (up to 65535 against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies past the end of the netlink attribute buffer with unsafe_memcpy(), leaking up to ~64KB of kernel heap memory into the transmitted NCSI command packet. The destination skb is sized by the declared payload, so the write side does not overflow - this is a pure OOB read / information leak, reachable with CAP_NET_ADMIN on systems with a registered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where NET_NCSI=y is standard). Reject commands whose declared payload extends past the end of the data attribute. The issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 e60afa01d35f8b2671b27ca93309921427144cce git Not specified
CNA Linux Linux affected 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 67c72b8ef63d9d9a610546fda30b116638f39745 git Not specified
CNA Linux Linux affected 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 4489b4a17892750131e4bef4bc1d3d703c8fb5ba git Not specified
CNA Linux Linux affected 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 43c7d0a6917751ea898ae584d00f24f5deac46d4 git Not specified
CNA Linux Linux affected 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 b5231ad0b376b801ab8cf2962b182cc29deaedb3 git Not specified
CNA Linux Linux affected 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 02226af69362758046822840fc6a497f5de33f00 git Not specified
CNA Linux Linux affected 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 3a60b5af75abe8e3494ccd074fb4ae6e601a3e55 git Not specified
CNA Linux Linux affected 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 afa58b7384913c8773d837acdb07b035690ec5d2 git Not specified
CNA Linux Linux affected 4.20 Not specified
CNA Linux Linux unaffected 4.20 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.152 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.104 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/67c72b8ef63d9d9a610546fda30b116638f39745 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3a60b5af75abe8e3494ccd074fb4ae6e601a3e55 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e60afa01d35f8b2671b27ca93309921427144cce 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4489b4a17892750131e4bef4bc1d3d703c8fb5ba 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/43c7d0a6917751ea898ae584d00f24f5deac46d4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/02226af69362758046822840fc6a497f5de33f00 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b5231ad0b376b801ab8cf2962b182cc29deaedb3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/afa58b7384913c8773d837acdb07b035690ec5d2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report