Executive brief
A security vulnerability has been identified in the Linux kernel's IBM ASM service processor driver. This flaw allows a user with administrative (root) privileges to trigger an improper memory read, potentially exposing sensitive kernel information or causing the service processor to become desynchronized. While it requires high privileges to exploit, it could lead to data leakage or hardware management instability.
Technical details
A heap over-read vulnerability exists in the ibmasm_send_i2o_message() function within drivers/misc/ibmasm/lowlevel.c. The function uses get_dot_command_size() to determine the length for a memcpy_toio() operation based on user-controlled header fields (command_size and data_size) without validating them against the actual buffer allocation. A local attacker with root privileges can provide a small buffer with inflated header values to read up to 65KB of adjacent kernel heap memory. This data is then forwarded to the service processor via MMIO. Additionally, the flaw could lead to hardware frame exhaustion if the command is rejected after dequeuing a frame from the controller's free pool. Patches have been released to validate command sizes and ensure proper hardware frame management.
Affected products
- Linux Linux Kernel Introduced in 2.6.12-rc2; fixed in various stable branches including 6.x
Timeline
- 2026-03-14: other: Vulnerability fix authored
- 2026-05-27: advisory: CVE-2026-46064 published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/9aad71144fa3682cca3837a06c8623016790e7ec
- https://git.kernel.org/stable/c/9e8f6c9d4ecddda2f28baa1678340286cff3969c
- https://git.kernel.org/stable/c/c1c2417c60dbdca5ebb00462f21ee71c2d7f7083
- https://git.kernel.org/stable/c/fd19eb1c75047a4ed4e855f56cafd704dc3914e0
- https://git.kernel.org/stable/c/fe31722b0194ff76bf8b461e8bf97a2081147787