CVE-2026-74694

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74694", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.926Z", "datePublished": "2026-08-22T15:32:57.113Z", "dateUpdated": "2026-08-22T15:32:57.113Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:57.113Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length\n\nncsi_send_cmd_nl() takes the number of bytes to copy from the\nattacker-controlled ncsi_pkt_hdr.length field of the in-band packet\nheader, while the source buffer is the NCSI_ATTR_DATA netlink\nattribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).\nThe two length sources are never cross-checked: only\nnla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.\n\nWith hdr->length set larger than the attribute payload (up to 65535\nagainst at most 2032 readable bytes), ncsi_cmd_handler_oem() copies\npast the end of the netlink attribute buffer with unsafe_memcpy(),\nleaking up to ~64KB of kernel heap memory into the transmitted NCSI\ncommand packet. The destination skb is sized by the declared payload,\nso the write side does not overflow - this is a pure OOB read /\ninformation leak, reachable with CAP_NET_ADMIN on systems with a\nregistered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where\nNET_NCSI=y is standard).\n\nReject commands whose declared payload extends past the end of the\ndata attribute.\n\nThe issue was found by the autokbug dynamic kernel fuzzer at Tencent\nYunding Lab."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ncsi/ncsi-netlink.c"], "versions": [{"version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "lessThan": "e60afa01d35f8b2671b27ca93309921427144cce", "status": "affected", "versionType": "git"}, {"version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "lessThan": "67c72b8ef63d9d9a610546fda30b116638f39745", "status": "affected", "versionType": "git"}, {"version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "lessThan": "4489b4a17892750131e4bef4bc1d3d703c8fb5ba", "status": "affected", "versionType": "git"}, {"version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "lessThan": "43c7d0a6917751ea898ae584d00f24f5deac46d4", "status": "affected", "versionType": "git"}, {"version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "lessThan": "b5231ad0b376b801ab8cf2962b182cc29deaedb3", "status": "affected", "versionType": "git"}, {"version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "lessThan": "02226af69362758046822840fc6a497f5de33f00", "status": "affected", "versionType": "git"}, {"version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "lessThan": "3a60b5af75abe8e3494ccd074fb4ae6e601a3e55", "status": "affected", "versionType": "git"}, {"version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "lessThan": "afa58b7384913c8773d837acdb07b035690ec5d2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ncsi/ncsi-netlink.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e60afa01d35f8b2671b27ca93309921427144cce"}, {"url": "https://git.kernel.org/stable/c/67c72b8ef63d9d9a610546fda30b116638f39745"}, {"url": "https://git.kernel.org/stable/c/4489b4a17892750131e4bef4bc1d3d703c8fb5ba"}, {"url": "https://git.kernel.org/stable/c/43c7d0a6917751ea898ae584d00f24f5deac46d4"}, {"url": "https://git.kernel.org/stable/c/b5231ad0b376b801ab8cf2962b182cc29deaedb3"}, {"url": "https://git.kernel.org/stable/c/02226af69362758046822840fc6a497f5de33f00"}, {"url": "https://git.kernel.org/stable/c/3a60b5af75abe8e3494ccd074fb4ae6e601a3e55"}, {"url": "https://git.kernel.org/stable/c/afa58b7384913c8773d837acdb07b035690ec5d2"}], "title": "net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ncsi/ncsi-netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e60afa01d35f8b2671b27ca93309921427144cce", "status": "affected", "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "versionType": "git"}, {"lessThan": "67c72b8ef63d9d9a610546fda30b116638f39745", "status": "affected", "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "versionType": "git"}, {"lessThan": "4489b4a17892750131e4bef4bc1d3d703c8fb5ba", "status": "affected", "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "versionType": "git"}, {"lessThan": "43c7d0a6917751ea898ae584d00f24f5deac46d4", "status": "affected", "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "versionType": "git"}, {"lessThan": "b5231ad0b376b801ab8cf2962b182cc29deaedb3", "status": "affected", "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "versionType": "git"}, {"lessThan": "02226af69362758046822840fc6a497f5de33f00", "status": "affected", "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "versionType": "git"}, {"lessThan": "3a60b5af75abe8e3494ccd074fb4ae6e601a3e55", "status": "affected", "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "versionType": "git"}, {"lessThan": "afa58b7384913c8773d837acdb07b035690ec5d2", "status": "affected", "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ncsi/ncsi-netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length\n\nncsi_send_cmd_nl() takes the number of bytes to copy from the\nattacker-controlled ncsi_pkt_hdr.length field of the in-band packet\nheader, while the source buffer is the NCSI_ATTR_DATA netlink\nattribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).\nThe two length sources are never cross-checked: only\nnla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.\n\nWith hdr->length set larger than the attribute payload (up to 65535\nagainst at most 2032 readable bytes), ncsi_cmd_handler_oem() copies\npast the end of the netlink attribute buffer with unsafe_memcpy(),\nleaking up to ~64KB of kernel heap memory into the transmitted NCSI\ncommand packet. The destination skb is sized by the declared payload,\nso the write side does not overflow - this is a pure OOB read /\ninformation leak, reachable with CAP_NET_ADMIN on systems with a\nregistered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where\nNET_NCSI=y is standard).\n\nReject commands whose declared payload extends past the end of the\ndata attribute.\n\nThe issue was found by the autokbug dynamic kernel fuzzer at Tencent\nYunding Lab."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/ncsi: correcci\u00f3n de lectura OOB de heap en la longitud de la carga \u00fatil de NCSI_CMD_SEND_CMD\n\nncsi_send_cmd_nl() toma el n\u00famero de bytes a copiar del campo ncsi_pkt_hdr.length, controlado por el atacante, del encabezado del paquete en banda, mientras que el b\u00fafer de origen es el atributo netlink NCSI_ATTR_DATA cuyo tama\u00f1o legible es nla_len() - sizeof(ncsi_pkt_hdr). Las dos fuentes de longitud nunca se cotejan: solo se aplica nla_len() >= sizeof(struct ncsi_pkt_hdr).\n\nCon hdr -> length establecido en un valor mayor que la carga \u00fatil del atributo (hasta 65535 frente a un m\u00e1ximo de 2032 bytes legibles), ncsi_cmd_handler_oem() copia m\u00e1s all\u00e1 del final del b\u00fafer del atributo netlink con unsafe_memcpy(), filtrando hasta ~64KB de memoria heap del kernel en el paquete de comando NCSI transmitido. El skb de destino se dimensiona seg\u00fan la carga \u00fatil declarada, por lo que el lado de escritura no desborda; esto es una lectura OOB pura / fuga de informaci\u00f3n, alcanzable con CAP_NET_ADMIN en sistemas con un dispositivo NCSI registrado (por ejemplo, OpenBMC en SoCs Aspeed BMC, donde NET_NCSI=y es est\u00e1ndar).\n\nRechazar comandos cuya carga \u00fatil declarada se extiende m\u00e1s all\u00e1 del final del atributo de datos.\n\nEl problema fue encontrado por el fuzzer din\u00e1mico de kernel autokbug en Tencent Yunding Lab."}], "id": "CVE-2026-74694", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:43.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/02226af69362758046822840fc6a497f5de33f00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a60b5af75abe8e3494ccd074fb4ae6e601a3e55"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/43c7d0a6917751ea898ae584d00f24f5deac46d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4489b4a17892750131e4bef4bc1d3d703c8fb5ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/67c72b8ef63d9d9a610546fda30b116638f39745"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/afa58b7384913c8773d837acdb07b035690ec5d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b5231ad0b376b801ab8cf2962b182cc29deaedb3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e60afa01d35f8b2671b27ca93309921427144cce"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length", "id": "2521439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521439"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length\nncsi_send_cmd_nl() takes the number of bytes to copy from the\nattacker-controlled ncsi_pkt_hdr.length field of the in-band packet\nheader, while the source buffer is the NCSI_ATTR_DATA netlink\nattribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).\nThe two length sources are never cross-checked: only\nnla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.\nWith hdr->length set larger than the attribute payload (up to 65535\nagainst at most 2032 readable bytes), ncsi_cmd_handler_oem() copies\npast the end of the netlink attribute buffer with unsafe_memcpy(),\nleaking up to ~64KB of kernel heap memory into the transmitted NCSI\ncommand packet. The destination skb is sized by the declared payload,\nso the write side does not overflow - this is a pure OOB read /\ninformation leak, reachable with CAP_NET_ADMIN on systems with a\nregistered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where\nNET_NCSI=y is standard).\nReject commands whose declared payload extends past the end of the\ndata attribute.\nThe issue was found by the autokbug dynamic kernel fuzzer at Tencent\nYunding Lab.", "A flaw was found in the Linux kernel's NCSI (Network Controller Sideband Interface) component. A local attacker with CAP_NET_ADMIN capabilities could exploit a heap out-of-bounds (OOB) read vulnerability. By crafting a malicious NCSI command with an oversized payload length, the attacker could cause the kernel to read past the intended buffer. This could lead to the disclosure of up to 64KB of sensitive kernel heap memory."], "name": "CVE-2026-74694", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74694\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74694\nhttps://lore.kernel.org/linux-cve-announce/2026082234-CVE-2026-74694-3e42@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392,e60afa01d35f8b2671b27ca93309921427144cce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392,67c72b8ef63d9d9a610546fda30b116638f39745)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392,4489b4a17892750131e4bef4bc1d3d703c8fb5ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392,43c7d0a6917751ea898ae584d00f24f5deac46d4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392,b5231ad0b376b801ab8cf2962b182cc29deaedb3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392,02226af69362758046822840fc6a497f5de33f00)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392,3a60b5af75abe8e3494ccd074fb4ae6e601a3e55)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392,afa58b7384913c8773d837acdb07b035690ec5d2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.265,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.216,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.183,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.152,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.104,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.45,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.9,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:15:03.690559+00:00", "updated": "2026-08-25T16:00:15.262184+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}