{"id":"CVE-2026-46022","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n\nibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read\nwhen the queue reader or writer …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n\nibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read\nwhen the queue reader or writer …","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-125"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.13, < 5.10.258","linux_kernel >= 5.11, < 5.15.209","linux_kernel >= 5.16, < 6.1.175","linux_kernel >= 6.2, < 6.6.140","linux_kernel >= 6.7, < 6.12.86","linux_kernel >= 6.13, < 6.18.27","linux_kernel >= 6.19, < 7.0.4"],"patched":["linux_kernel 7.0.4"],"published":"2026-05-27","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:38.767","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46022","references":[{"url":"https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00167,"epssPercentile":0.05522,"ingestedAt":"2026-10-15T03:30:12.881Z","slug":"CVE-2026-46022","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n\nibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read\nwhen the queue reader or writer index from hardware exceeds\nREMOTE_QUEUE_SIZE (60).\n\nA compromised service processor can trigger this by writing an\nout-of-range value to the reader or writer MMIO register before\nasserting an interrupt. Since writer is re-read from hardware on\nevery loop iteration, it can also be set to an out-of-range value\nafter the loop has already started.\n\nThe root cause is that get_queue_reader() and get_queue_writer() return\nraw readl() values that are passed directly into get_queue_entry(),\nwhich computes:\n\n  queue_begin + reader * sizeof(struct remote_input)\n\nwith no bounds check. This unchecked MMIO address is then passed to\nmemcpy_fromio(), reading 8 bytes from unintended device registers.\nFor sufficiently large values the address falls outside the PCI BAR\nmapping entirely, triggering a machine check exception.\n\nFix by checking both indices against REMOTE_QUEUE_SIZE at the top of\nthe loop body, before any call to get_queue_entry(). On an out-of-range\nvalue, reset the reader register to 0 via set_queue_reader() before\nbreaking, so that normal queue operation can resume if the corrupted\nhardware state is transient.\n\n## Affected\n\n- `linux_kernel >= 2.6.13, < 5.10.258`\n- `linux_kernel >= 5.11, < 5.15.209`\n- `linux_kernel >= 5.16, < 6.1.175`\n- `linux_kernel >= 6.2, < 6.6.140`\n- `linux_kernel >= 6.7, < 6.12.86`\n- `linux_kernel >= 6.13, < 6.18.27`\n- `linux_kernel >= 6.19, < 7.0.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.4`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}