CVE-2026-74551

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74551", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.915Z", "datePublished": "2026-08-15T12:27:58.237Z", "dateUpdated": "2026-08-19T16:38:47.362Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:38:47.362Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nzxt-smart2) DMA-align output buffer\n\nSashiko reports:\n\nWhen send_output_report() calls hid_hw_output_report(), the underlying USB\nHID core calls usb_interrupt_msg() which maps this buffer directly for DMA.\n\nWhen the DMA mapping flushes or invalidates the cacheline, it will corrupt\nthe adjacent variables (mutex, update_interval) that were modified\nconcurrently by the CPU. This causes memory corruption due to cacheline\nsharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA\nAPI debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings\nfor this violation.\n\nAny operation that triggers send_output_report() (like setting a fan speed\nor updating the interval) causes the USB DMA mapping. On systems with\nnon-coherent caches, this structural bug causes immediate and deterministic\nmemory corruption.\n\nAlign the output buffer to ARCH_DMA_MINALIGN to fix the problem."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable send_output_report() path is reached by writing hwmon sysfs attributes (pwm*, update_interval) under /sys/class/hwmon/, a local interface. The USB stack only performs internal DMA mapping; the attacker does not need network, adjacent-network, or direct USB bus manipulation to trigger the bug.\nAC:L - On non-coherent ARM/MIPS systems, each sysfs write that triggers send_output_report() deterministically causes DMA cache-line operations that corrupt the adjacent mutex and update_interval; the attacker controls when writes occur and can repeat them at will with no race or grooming required.\nPR:L - The driver exposes pwm* and update_interval hwmon attributes with mode 0644 and performs no capability or credential checks on the write path; any unprivileged local user account can trigger send_output_report() without real root or init-namespace capabilities.\nUI:N - Exploitation requires only the attacker writing to hwmon sysfs on a system where the NZXT device is already present and bound; no victim action such as opening a file, clicking a prompt, or mounting a filesystem is needed beyond normal device presence at boot.\nS:U - Corruption is confined to kernel driver private data (mutex, update_interval) within the host kernel heap; impact is standard kernel memory corruption and potential privilege escalation, not crossing VM, container, or IOMMU security boundaries.\nC:H - DMA cache-line invalidation corrupts adjacent kernel structures including struct mutex while concurrently modified by the CPU; this class of heap-adjacent memory corruption is a general primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Corrupting an actively held struct mutex in kernel driver private data enables control of synchronization state and adjacent heap contents, providing an exploitable kernel memory corruption primitive suitable for arbitrary write and control-flow hijacking.\nA:H - Corrupted mutex and driver state cause immediate kernel instability including possible deadlock, oops, or panic on every triggering sysfs write on affected non-coherent architectures; the fix commit describes immediate and deterministic memory corruption."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwmon/nzxt-smart2.c"], "versions": [{"version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "lessThan": "81a6593b1c8dfb2694cd0ce39be01212d2b8436c", "status": "affected", "versionType": "git"}, {"version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "lessThan": "70ad543ce81f368411b6c721265a3b2d7ab4fda4", "status": "affected", "versionType": "git"}, {"version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "lessThan": "51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f", "status": "affected", "versionType": "git"}, {"version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "lessThan": "2332d35aaf206c17acf848522817252732596676", "status": "affected", "versionType": "git"}, {"version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "lessThan": "6a2dbce5da2d2163a5b684acf68a0e54582ff0fa", "status": "affected", "versionType": "git"}, {"version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "lessThan": "080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwmon/nzxt-smart2.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/81a6593b1c8dfb2694cd0ce39be01212d2b8436c"}, {"url": "https://git.kernel.org/stable/c/70ad543ce81f368411b6c721265a3b2d7ab4fda4"}, {"url": "https://git.kernel.org/stable/c/51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f"}, {"url": "https://git.kernel.org/stable/c/2332d35aaf206c17acf848522817252732596676"}, {"url": "https://git.kernel.org/stable/c/6a2dbce5da2d2163a5b684acf68a0e54582ff0fa"}, {"url": "https://git.kernel.org/stable/c/080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8"}], "title": "hwmon: (nzxt-smart2) DMA-align output buffer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hwmon/nzxt-smart2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "81a6593b1c8dfb2694cd0ce39be01212d2b8436c", "status": "affected", "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "versionType": "git"}, {"lessThan": "70ad543ce81f368411b6c721265a3b2d7ab4fda4", "status": "affected", "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "versionType": "git"}, {"lessThan": "51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f", "status": "affected", "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "versionType": "git"}, {"lessThan": "2332d35aaf206c17acf848522817252732596676", "status": "affected", "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "versionType": "git"}, {"lessThan": "6a2dbce5da2d2163a5b684acf68a0e54582ff0fa", "status": "affected", "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "versionType": "git"}, {"lessThan": "080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8", "status": "affected", "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hwmon/nzxt-smart2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nzxt-smart2) DMA-align output buffer\n\nSashiko reports:\n\nWhen send_output_report() calls hid_hw_output_report(), the underlying USB\nHID core calls usb_interrupt_msg() which maps this buffer directly for DMA.\n\nWhen the DMA mapping flushes or invalidates the cacheline, it will corrupt\nthe adjacent variables (mutex, update_interval) that were modified\nconcurrently by the CPU. This causes memory corruption due to cacheline\nsharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA\nAPI debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings\nfor this violation.\n\nAny operation that triggers send_output_report() (like setting a fan speed\nor updating the interval) causes the USB DMA mapping. On systems with\nnon-coherent caches, this structural bug causes immediate and deterministic\nmemory corruption.\n\nAlign the output buffer to ARCH_DMA_MINALIGN to fix the problem."}], "id": "CVE-2026-74551", "lastModified": "2026-08-19T17:21:10.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:18:00.500", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2332d35aaf206c17acf848522817252732596676"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a2dbce5da2d2163a5b684acf68a0e54582ff0fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/70ad543ce81f368411b6c721265a3b2d7ab4fda4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81a6593b1c8dfb2694cd0ce39be01212d2b8436c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: hwmon: (nzxt-smart2) DMA-align output buffer", "id": "2517033", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517033"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nhwmon: (nzxt-smart2) DMA-align output buffer\nSashiko reports:\nWhen send_output_report() calls hid_hw_output_report(), the underlying USB\nHID core calls usb_interrupt_msg() which maps this buffer directly for DMA.\nWhen the DMA mapping flushes or invalidates the cacheline, it will corrupt\nthe adjacent variables (mutex, update_interval) that were modified\nconcurrently by the CPU. This causes memory corruption due to cacheline\nsharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA\nAPI debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings\nfor this violation.\nAny operation that triggers send_output_report() (like setting a fan speed\nor updating the interval) causes the USB DMA mapping. On systems with\nnon-coherent caches, this structural bug causes immediate and deterministic\nmemory corruption.\nAlign the output buffer to ARCH_DMA_MINALIGN to fix the problem.", "A flaw was found in the Linux kernel's `hwmon: (nzxt-smart2)` driver. This vulnerability allows for immediate and deterministic memory corruption on systems with non-coherent CPU architectures, such as ARM or MIPS. When operations like setting a fan speed or updating an interval trigger a USB Direct Memory Access (DMA) mapping, the DMA process can corrupt adjacent variables due to cacheline sharing. This issue is resolved by aligning the output buffer to prevent unintended data corruption."], "name": "CVE-2026-74551", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74551\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74551\nhttps://lore.kernel.org/linux-cve-announce/2026081550-CVE-2026-74551-720e@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[53e68c20aeb1e23419bed811aa3a309ceda200f9,70ad543ce81f368411b6c721265a3b2d7ab4fda4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[53e68c20aeb1e23419bed811aa3a309ceda200f9,51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[53e68c20aeb1e23419bed811aa3a309ceda200f9,2332d35aaf206c17acf848522817252732596676)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[53e68c20aeb1e23419bed811aa3a309ceda200f9,6a2dbce5da2d2163a5b684acf68a0e54582ff0fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[53e68c20aeb1e23419bed811aa3a309ceda200f9,080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T15:15:03.212047+00:00", "updated": "2026-08-21T19:30:05.191550+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}