FKIE_CVE-2026-74694

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-14 13:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length ncsi_send_cmd_nl() takes the number of bytes to copy from the attacker-controlled ncsi_pkt_hdr.length field of the in-band packet header, while the source buffer is the NCSI_ATTR_DATA netlink attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr). The two length sources are never cross-checked: only nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced. With hdr->length set larger than the attribute payload (up to 65535 against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies past the end of the netlink attribute buffer with unsafe_memcpy(), leaking up to ~64KB of kernel heap memory into the transmitted NCSI command packet. The destination skb is sized by the declared payload, so the write side does not overflow - this is a pure OOB read / information leak, reachable with CAP_NET_ADMIN on systems with a registered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where NET_NCSI=y is standard). Reject commands whose declared payload extends past the end of the data attribute. The issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/02226af69362758046822840fc6a497f5de33f00
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3a60b5af75abe8e3494ccd074fb4ae6e601a3e55
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/43c7d0a6917751ea898ae584d00f24f5deac46d4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4489b4a17892750131e4bef4bc1d3d703c8fb5ba
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/67c72b8ef63d9d9a610546fda30b116638f39745
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/afa58b7384913c8773d837acdb07b035690ec5d2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b5231ad0b376b801ab8cf2962b182cc29deaedb3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e60afa01d35f8b2671b27ca93309921427144cce
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ncsi/ncsi-netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e60afa01d35f8b2671b27ca93309921427144cce",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "67c72b8ef63d9d9a610546fda30b116638f39745",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "4489b4a17892750131e4bef4bc1d3d703c8fb5ba",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "43c7d0a6917751ea898ae584d00f24f5deac46d4",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "b5231ad0b376b801ab8cf2962b182cc29deaedb3",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "02226af69362758046822840fc6a497f5de33f00",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "3a60b5af75abe8e3494ccd074fb4ae6e601a3e55",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "afa58b7384913c8773d837acdb07b035690ec5d2",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ncsi/ncsi-netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length\n\nncsi_send_cmd_nl() takes the number of bytes to copy from the\nattacker-controlled ncsi_pkt_hdr.length field of the in-band packet\nheader, while the source buffer is the NCSI_ATTR_DATA netlink\nattribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).\nThe two length sources are never cross-checked: only\nnla_len() \u003e= sizeof(struct ncsi_pkt_hdr) is enforced.\n\nWith hdr-\u003elength set larger than the attribute payload (up to 65535\nagainst at most 2032 readable bytes), ncsi_cmd_handler_oem() copies\npast the end of the netlink attribute buffer with unsafe_memcpy(),\nleaking up to ~64KB of kernel heap memory into the transmitted NCSI\ncommand packet. The destination skb is sized by the declared payload,\nso the write side does not overflow - this is a pure OOB read /\ninformation leak, reachable with CAP_NET_ADMIN on systems with a\nregistered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where\nNET_NCSI=y is standard).\n\nReject commands whose declared payload extends past the end of the\ndata attribute.\n\nThe issue was found by the autokbug dynamic kernel fuzzer at Tencent\nYunding Lab."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/ncsi: correcci\u00f3n de lectura OOB de heap en la longitud de la carga \u00fatil de NCSI_CMD_SEND_CMD\n\nncsi_send_cmd_nl() toma el n\u00famero de bytes a copiar del campo ncsi_pkt_hdr.length, controlado por el atacante, del encabezado del paquete en banda, mientras que el b\u00fafer de origen es el atributo netlink NCSI_ATTR_DATA cuyo tama\u00f1o legible es nla_len() - sizeof(ncsi_pkt_hdr). Las dos fuentes de longitud nunca se cotejan: solo se aplica nla_len() \u003e= sizeof(struct ncsi_pkt_hdr).\n\nCon hdr -\u003e length establecido en un valor mayor que la carga \u00fatil del atributo (hasta 65535 frente a un m\u00e1ximo de 2032 bytes legibles), ncsi_cmd_handler_oem() copia m\u00e1s all\u00e1 del final del b\u00fafer del atributo netlink con unsafe_memcpy(), filtrando hasta ~64KB de memoria heap del kernel en el paquete de comando NCSI transmitido. El skb de destino se dimensiona seg\u00fan la carga \u00fatil declarada, por lo que el lado de escritura no desborda; esto es una lectura OOB pura / fuga de informaci\u00f3n, alcanzable con CAP_NET_ADMIN en sistemas con un dispositivo NCSI registrado (por ejemplo, OpenBMC en SoCs Aspeed BMC, donde NET_NCSI=y es est\u00e1ndar).\n\nRechazar comandos cuya carga \u00fatil declarada se extiende m\u00e1s all\u00e1 del final del atributo de datos.\n\nEl problema fue encontrado por el fuzzer din\u00e1mico de kernel autokbug en Tencent Yunding Lab."
    }
  ],
  "id": "CVE-2026-74694",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {},
  "published": "2026-08-22T16:16:43.920",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/02226af69362758046822840fc6a497f5de33f00"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3a60b5af75abe8e3494ccd074fb4ae6e601a3e55"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/43c7d0a6917751ea898ae584d00f24f5deac46d4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4489b4a17892750131e4bef4bc1d3d703c8fb5ba"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/67c72b8ef63d9d9a610546fda30b116638f39745"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/afa58b7384913c8773d837acdb07b035690ec5d2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b5231ad0b376b801ab8cf2962b182cc29deaedb3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e60afa01d35f8b2671b27ca93309921427144cce"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.