CVE-2026-74694

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap out-of-bounds read exists in the NCSI (Network Controller Sideband Interface) implementation. The function ncsi send cmd nl() uses the length field from the ncsi pkt hdr structure to determine how many bytes to copy, but it fails to cross-check this value against the actual size of the NCSI ATTR DATA netlink attribute. An attacker with CAP NET ADMIN privileges on a system with a registered NCSI device can set hdr->length to a value larger than the attribute payload, causing ncsi cmd handler oem() to use unsafe memcpy() to read past the end of the netlink attribute buffer. This results in an information leak of up to 64KB of kernel heap memory into the transmitted NCSI command packet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.