---
id: CVE-2026-74694
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

  ncsi_send_cmd_nl() takes the number of bytes to copy from the
  attacker-controlled ncsi_pkt_hdr.length f…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

  ncsi_send_cmd_nl() takes the number of bytes to copy from the
  attacker-controlled ncsi_pkt_hdr.length f…
severity: none
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74694'
references:
  - url: 'https://git.kernel.org/stable/c/02226af69362758046822840fc6a497f5de33f00'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3a60b5af75abe8e3494ccd074fb4ae6e601a3e55'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/43c7d0a6917751ea898ae584d00f24f5deac46d4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4489b4a17892750131e4bef4bc1d3d703c8fb5ba'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/67c72b8ef63d9d9a610546fda30b116638f39745'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/afa58b7384913c8773d837acdb07b035690ec5d2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b5231ad0b376b801ab8cf2962b182cc29deaedb3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e60afa01d35f8b2671b27ca93309921427144cce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.0022
epssPercentile: 0.11528
ingestedAt: '2026-10-14T13:30:58.539Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

ncsi_send_cmd_nl() takes the number of bytes to copy from the
attacker-controlled ncsi_pkt_hdr.length field of the in-band packet
header, while the source buffer is the NCSI_ATTR_DATA netlink
attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).
The two length sources are never cross-checked: only
nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.

With hdr->length set larger than the attribute payload (up to 65535
against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies
past the end of the netlink attribute buffer with unsafe_memcpy(),
leaking up to ~64KB of kernel heap memory into the transmitted NCSI
command packet. The destination skb is sized by the declared payload,
so the write side does not overflow - this is a pure OOB read /
information leak, reachable with CAP_NET_ADMIN on systems with a
registered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where
NET_NCSI=y is standard).

Reject commands whose declared payload extends past the end of the
data attribute.

The issue was found by the autokbug dynamic kernel fuzzer at Tencent
Yunding Lab.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.