CVE-2026-74551
Received Received - Intake

Memory Corruption in NZXT Smart2 Kernel Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) DMA-align output buffer Sashiko reports: When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA. When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation. Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption. Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74551
EUVD
EUVD-2026-59616

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory corruption issue in the Linux kernel's hwmon subsystem, specifically affecting the NZXT Smart2 hardware monitoring driver. It occurs when the driver's output buffer is not properly aligned for DMA operations, causing cacheline corruption on non-coherent CPU architectures like ARM or MIPS. This leads to adjacent variables being corrupted when the DMA mapping flushes or invalidates the cache.

Detection Guidance

This vulnerability affects the Linux kernel's hwmon driver for NZXT Smart2 devices. Detection requires checking kernel logs for DMA API debugging warnings or memory corruption errors related to the nzxt-smart2 module. Use dmesg | grep -i dma or dmesg | grep -i nzxt-smart2 to inspect logs for DMA-related issues.

Impact Analysis

On systems with non-coherent caches, this vulnerability can cause immediate and deterministic memory corruption whenever operations like setting fan speed or updating intervals trigger USB DMA mappings. This may lead to system instability, crashes, or unpredictable behavior. The DMA API debugging tool may also trigger runtime warnings.

Mitigation Strategies

Apply the kernel patch that aligns the output buffer to ARCH_DMA_MINALIGN. Update your Linux kernel to a version containing the fix. If a patch is unavailable, disable the nzxt-smart2 module by blacklisting it or removing the hardware until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74551. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart