CVE-2026-46022

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1

Description An out-of-bounds MMIO (Memory Mapped I/O) read exists in the ibmasm handle mouse interrupt() function. This occurs when the queue reader or writer index from the hardware exceeds REMOTE QUEUE SIZE (60). A compromised service processor can trigger this by writing an out-of-range value to the reader or writer MMIO register. The functions get queue reader() and get queue writer() return raw values that are passed to get queue entry() without bounds checking. This results in memcpy fromio() reading 8 bytes from unintended device registers. If the values are sufficiently large, the address may fall outside the PCI BAR (Base Address Register) mapping, causing a machine check exception.

Recommendations Update to version 7.0.11-1.1.