{"id":"CVE-2026-46064","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix heap over-read in ibmasm_send_i2o_message()\n\nThe ibmasm_send_i2o_message() function uses get_dot_command_size() to\ncompute the byte count for memcpy_toio(),…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix heap over-read in ibmasm_send_i2o_message()\n\nThe ibmasm_send_i2o_message() function uses get_dot_command_size() to\ncompute the byte count for memcpy_toio(),…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-125"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.12.1, < 5.10.258","linux_kernel >= 5.11, < 5.15.209","linux_kernel >= 5.16, < 6.1.175","linux_kernel >= 6.2, < 6.6.140","linux_kernel >= 6.7, < 6.12.86","linux_kernel >= 6.13, < 6.18.27","linux_kernel >= 6.19, < 7.0.4","linux_kernel = 2.6.12"],"patched":["linux_kernel 7.0.4"],"published":"2026-05-27","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:41.027","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46064","references":[{"url":"https://git.kernel.org/stable/c/9aad71144fa3682cca3837a06c8623016790e7ec","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e8f6c9d4ecddda2f28baa1678340286cff3969c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b870f652877bfbe321bd0f4096fc37a93296f7b6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1c2417c60dbdca5ebb00462f21ee71c2d7f7083","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca1c857e2bb74a9fc0606128334f85316d57067b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce57fa439bd1b5d664f334a0c3e3f0e42abb0153","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd19eb1c75047a4ed4e855f56cafd704dc3914e0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe31722b0194ff76bf8b461e8bf97a2081147787","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00167,"epssPercentile":0.05522,"ingestedAt":"2026-10-15T03:30:12.884Z","slug":"CVE-2026-46064","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix heap over-read in ibmasm_send_i2o_message()\n\nThe ibmasm_send_i2o_message() function uses get_dot_command_size() to\ncompute the byte count for memcpy_toio(), but this value is derived from\nuser-controlled fields in the dot_command_header (command_size: u8,\ndata_size: u16) and is never validated against the actual allocation size.\nA root user can write a small buffer with inflated header fields, causing\nmemcpy_toio() to read up to ~65 KB past the end of the allocation into\nadjacent kernel heap, which is then forwarded to the service processor\nover MMIO.\n\nSilently clamping the copy size is not sufficient: if the header fields\nclaim a larger size than the buffer, the SP receives a dot command whose\nown header is inconsistent with the I2O message length, which can cause\nthe SP to desynchronize. Reject such commands outright by returning\nfailure.\n\nValidate command_size before calling get_mfa_inbound() to avoid leaking\nan I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware\nframe from the controller's free pool, and returning without a\ncorresponding set_mfa_inbound() call would permanently exhaust it.\n\nAdditionally, clamp command_size to I2O_COMMAND_SIZE before the\nmemcpy_toio() so the MMIO write stays within the I2O message frame,\nconsistent with the clamping already performed by outgoing_message_size()\nfor the header field.\n\n## Affected\n\n- `linux_kernel >= 2.6.12.1, < 5.10.258`\n- `linux_kernel >= 5.11, < 5.15.209`\n- `linux_kernel >= 5.16, < 6.1.175`\n- `linux_kernel >= 6.2, < 6.6.140`\n- `linux_kernel >= 6.7, < 6.12.86`\n- `linux_kernel >= 6.13, < 6.18.27`\n- `linux_kernel >= 6.19, < 7.0.4`\n- `linux_kernel = 2.6.12`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.4`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}