CVE-2026-74729
Received Received - Intake

Buffer Overflow in Aspeed LPC Snoop Driver

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing with snoop_file_read(), which also consumes via kfifo_to_user(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp to (in - out) is ineffective and kfifo_copy_to_user() can attempt a copy_to_user() past the kmalloc-2k backing store: usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-2k' (offset 0, size 2049)! kernel BUG at mm/usercopy.c! Call trace: usercopy_abort __check_heap_object __check_object_size kfifo_copy_to_user __kfifo_to_user snoop_file_read vfs_read Serialize kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer). Annotate @fifo with __guarded_by(&lock) and opt the driver into context analysis so the compiler enforces that all fifo access holds the lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74729
EUVD
EUVD-2026-64416

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aspeed lpc-snoop *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a kernel memory exposure issue in the Linux kernel's Aspeed LPC snoop driver. It occurs due to a race condition in the kfifo data structure used for communication between an IRQ handler and a file reader. The handler and reader concurrently access the fifo without proper synchronization, causing the fifo indices to become misaligned. This can lead to a buffer overflow when copying data to userspace, potentially exposing sensitive kernel memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's aspeed lpc-snoop driver and requires kernel-level access to detect. No direct network detection commands are available. Check kernel logs for usercopy abort messages or BUG reports related to kmalloc-2k slub objects. Use dmesg | grep usercopy or dmesg | grep BUG to search for related errors.

Impact Analysis

On SMP systems, this flaw could allow an attacker with local access to trigger a kernel memory corruption. This might result in system crashes, privilege escalation, or unauthorized memory exposure. The impact depends on kernel memory layout and privileges, but successful exploitation could compromise system integrity or confidentiality.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-74729. If immediate patching is not possible, disable the aspeed lpc-snoop driver by unloading its kernel module (rmmod aspeed-lpc-snoop) or blacklisting it to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74729. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart