{"id":"CVE-2026-74694","summary":"net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length\n\nncsi_send_cmd_nl() takes the number of bytes to copy from the\nattacker-controlled ncsi_pkt_hdr.length field of the in-band packet\nheader, while the source buffer is the NCSI_ATTR_DATA netlink\nattribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).\nThe two length sources are never cross-checked: only\nnla_len() \u003e= sizeof(struct ncsi_pkt_hdr) is enforced.\n\nWith hdr-\u003elength set larger than the attribute payload (up to 65535\nagainst at most 2032 readable bytes), ncsi_cmd_handler_oem() copies\npast the end of the netlink attribute buffer with unsafe_memcpy(),\nleaking up to ~64KB of kernel heap memory into the transmitted NCSI\ncommand packet. The destination skb is sized by the declared payload,\nso the write side does not overflow - this is a pure OOB read /\ninformation leak, reachable with CAP_NET_ADMIN on systems with a\nregistered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where\nNET_NCSI=y is standard).\n\nReject commands whose declared payload extends past the end of the\ndata attribute.\n\nThe issue was found by the autokbug dynamic kernel fuzzer at Tencent\nYunding Lab.","modified":"2026-09-18T10:11:41.623696080Z","published":"2026-08-22T15:32:57.113Z","related":["SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74694.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/02226af69362758046822840fc6a497f5de33f00"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3a60b5af75abe8e3494ccd074fb4ae6e601a3e55"},{"type":"WEB","url":"https://git.kernel.org/stable/c/43c7d0a6917751ea898ae584d00f24f5deac46d4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4489b4a17892750131e4bef4bc1d3d703c8fb5ba"},{"type":"WEB","url":"https://git.kernel.org/stable/c/67c72b8ef63d9d9a610546fda30b116638f39745"},{"type":"WEB","url":"https://git.kernel.org/stable/c/afa58b7384913c8773d837acdb07b035690ec5d2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b5231ad0b376b801ab8cf2962b182cc29deaedb3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e60afa01d35f8b2671b27ca93309921427144cce"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74694.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74694"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392"},{"fixed":"e60afa01d35f8b2671b27ca93309921427144cce"},{"fixed":"67c72b8ef63d9d9a610546fda30b116638f39745"},{"fixed":"4489b4a17892750131e4bef4bc1d3d703c8fb5ba"},{"fixed":"43c7d0a6917751ea898ae584d00f24f5deac46d4"},{"fixed":"b5231ad0b376b801ab8cf2962b182cc29deaedb3"},{"fixed":"02226af69362758046822840fc6a497f5de33f00"},{"fixed":"3a60b5af75abe8e3494ccd074fb4ae6e601a3e55"},{"fixed":"afa58b7384913c8773d837acdb07b035690ec5d2"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74694.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.10.265"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.216"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.152"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.104"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.45"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74694.json"}}],"schema_version":"1.9.0"}