CVE-2026-74694
Received Received - Intake

Heap OOB Read in Linux Kernel NCSI Implementation

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length ncsi_send_cmd_nl() takes the number of bytes to copy from the attacker-controlled ncsi_pkt_hdr.length field of the in-band packet header, while the source buffer is the NCSI_ATTR_DATA netlink attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr). The two length sources are never cross-checked: only nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced. With hdr->length set larger than the attribute payload (up to 65535 against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies past the end of the netlink attribute buffer with unsafe_memcpy(), leaking up to ~64KB of kernel heap memory into the transmitted NCSI command packet. The destination skb is sized by the declared payload, so the write side does not overflow - this is a pure OOB read / information leak, reachable with CAP_NET_ADMIN on systems with a registered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where NET_NCSI=y is standard). Reject commands whose declared payload extends past the end of the data attribute. The issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74694
EUVD
EUVD-2026-64381

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap out-of-bounds (OOB) read vulnerability in the Linux kernel's NCSI (Network Controller Sideband Interface) component. It occurs when processing attacker-controlled payload lengths in NCSI command packets. The vulnerability allows reading up to 64KB of kernel heap memory beyond the intended buffer due to insufficient validation of length fields.

Detection Guidance

This vulnerability is specific to systems with NCSI (Network Controller Sideband Interface) devices, particularly those using OpenBMC on Aspeed BMC SoCs. Detection requires checking for kernel heap memory leaks via NCSI command handling. No direct commands are provided in the context, but monitoring for unusual memory usage or kernel logs related to NCSI operations may help. Ensure your kernel is updated to a patched version.

Impact Analysis

An attacker with CAP_NET_ADMIN privileges on a system with a registered NCSI device (like OpenBMC on Aspeed BMC SoCs) could exploit this to leak sensitive kernel memory. This could potentially expose sensitive data or aid in further attacks, though it does not allow direct code execution or system compromise.

Mitigation Strategies

Apply the latest kernel patches that address this issue. If using a vulnerable kernel, restrict CAP_NET_ADMIN privileges to untrusted users. Disable NCSI if not required by your system. Monitor vendor advisories for OpenBMC or Aspeed BMC SoCs for specific mitigations. Update to a kernel version where this issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74694. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart