CVE-2026-74729

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A usercopy overflow exists in the snoop file read() function within the aspeed LPC snoop driver. The put fifo with discard() function operates as both a producer and consumer on the kfifo, calling kfifo skip() and kfifo put() from the IRQ handler without synchronization with snoop file read(), which also consumes data via kfifo to user(). On SMP (Symmetric Multiprocessing) systems, this concurrent access can cause the difference between the input and output pointers to exceed the ring buffer size. Consequently, the clamp in kfifo to user() becomes ineffective, allowing kfifo copy to user() to attempt a memory copy beyond the kmalloc-2k backing store, potentially leading to kernel memory exposure.

Recommendations Serialize kfifo access by implementing a per-channel spinlock shared between the IRQ handler and the file reader. Annotate the @fifo variable with guarded by(&lock) and enable driver context analysis to ensure the compiler enforces lock acquisition for all fifo access.