Executive brief
The Linux kernel's NCSI (NC-SI) network interface handler contains a heap memory disclosure vulnerability in its netlink command processing. An authenticated attacker with CAP_NET_ADMIN capability can send specially crafted network commands that read beyond the bounds of an internal buffer, exposing up to 64 KB of sensitive kernel memory. This vulnerability affects systems with NCSI devices enabled, such as OpenBMC platforms, and could leak kernel heap data containing credentials, cryptographic keys, or other sensitive information.
Technical details
The vulnerability is a heap out-of-bounds (OOB) read in the ncsi_send_cmd_nl() function within net/ncsi/ncsi-netlink.c. The root cause is that the function takes a payload length from an attacker-controlled field (ncsi_pkt_hdr.length) without validating it against the actual size of the netlink attribute buffer (NCSI_ATTR_DATA). When hdr->length is set to a value larger than the source buffer (up to 65535 bytes), the subsequent unsafe_memcpy() call reads past the end of the netlink attribute, leaking kernel heap memory into the transmitted NCSI packet. The attack requires CAP_NET_ADMIN privilege and a registered NCSI device. A simple length check comparing the declared payload against the available buffer size (nca.payload > len - sizeof(*hdr)) mitigates this issue; the fix is included in stable kernel series.
Affected products
- Linux Linux kernel Multiple versions (patch available in upstream; affects systems with NET_NCSI enabled)
Timeline
- 2026-08-22: disclosed: CVE-2026-74694 published