CVE-2026-64407

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the nxp recv fw req v3() function during v3 firmware downloads. The issue occurs because the function only verifies the lower bound of the offset provided in a v3 data req and fails to check if the sum of the fw dnld v3 offset and len variables remains within the nxpdev->fw->size limit. Consequently, a controller requesting an offset or length beyond the firmware image can force the driver to read memory past the end of nxpdev->fw->data and transmit that data over UART.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.