Executive brief
The Linux kernel's Nitro Secure Module (NSM) driver contains a vulnerability where a malicious or faulty backend device can report an artificially large response buffer length, causing the driver to leak sensitive kernel heap memory to user space. This could allow an attacker with the ability to control the NSM backend device to read confidential kernel data, compromising system security and privacy.
Technical details
The vulnerability is an out-of-bounds read in the NSM driver's nsm_sendrecv_msg_locked() function. The function accepts a device-reported response length without validating it against the actual response buffer size, then parse_resp_raw() copies that many bytes to user space. A malicious or buggy backend device can report a length larger than the response buffer, allowing the kernel to copy adjacent heap memory. The request path already implements bounds checking via fill_req_raw(), but the response path lacked the symmetric validation. The fix clamps the stored response length to sizeof(msg->resp.data) using min_t(), preventing out-of-bounds access while maintaining compatibility with well-behaved devices.
Affected products
- Linux Linux kernel Affected versions from introduction in commit b9873755a6c8 through patched versions
Timeline
- 2026-09-11: disclosed: Published to NVD
- 2026-09-07: patched: Commit 808e530654a5354e6df78863a5d61e4d44e67235 upstream; backported to stable branches