Executive brief
A vulnerability was identified in the Linux kernel's IBM ASM service processor driver. This driver allows the operating system to communicate with hardware management components. An attacker with local access could exploit this flaw to read sensitive information from the system's memory, potentially exposing data from other programs or the operating system itself.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the ibmasm driver within the command_file_write() handler in drivers/misc/ibmasm/ibmasmfs.c. The issue stems from a lack of validation of user-supplied buffer sizes against the dot command protocol headers. Specifically, an attacker can control both the allocation size and the header fields (command_size, data_size), allowing them to craft a command where the declared size exceeds the actual buffer allocation. This results in OOB reads during get_dot_command_timeout() and an out-of-bounds memcpy_toio() that leaks kernel heap memory to the service processor. The fix introduces size checks to ensure the buffer is large enough to contain the declared header and payload.
Affected products
- Linux Linux Kernel Introduced in 2.6.12-rc2; fixed in various stable branches including 6.x and earlier.
Timeline
- 2026-03-14: disclosed: Initial patch submitted by Tyllis Xu
- 2026-05-27: advisory: CVE-2026-45994 published
References
- https://git.kernel.org/stable/c/0eb09f737428e482a32a2e31e5e223f2b35a71d3
- https://git.kernel.org/stable/c/a672682d39dd34e2b5ba4feb436723bed65125ff
- https://git.kernel.org/stable/c/aefc1a97da17d8309974690c8a03e439a91ebb1c
- https://git.kernel.org/stable/c/d0fb4d1dc43f8d5179917a2daaa82680993d4cdf
- https://git.kernel.org/stable/c/ee5737891464030a189837467df3b81a273718ad