PT-2026-73003
CVE-2026-74551
·
Published
2026-07-27
·
Updated
2026-11-03
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
Memory corruption occurs on non-coherent CPU architectures, such as ARM or MIPS, due to cacheline sharing. The issue arises when the
send output report() function calls hid hw output report(), leading the USB HID core to execute usb interrupt msg(), which maps the output buffer directly for Direct Memory Access (DMA). When the DMA mapping flushes or invalidates the cacheline, it corrupts adjacent variables, specifically mutex and update interval, which are modified concurrently by the CPU. This corruption is triggered by any operation that invokes send output report(), such as updating the interval or setting fan speed.Recommendations
Align the output buffer to
ARCH DMA MINALIGN to resolve the memory corruption issue. Found an issue in the description? Have something to add? Feel free to write us 👾