CVE-2026-74603: ptp: ocp: Fix board ID over-read
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: Fix board ID over-read
The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlinkinfoversionfixedput() treats it as a C string and may read beyond the field.
Format at most OCPBOARDIDLEN bytes into the existing local buffer before reporting the ID. Use a precision limit because the snprintf() output size alone does not bound the source string scan.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this over-read?
The issue is in the Linux kernel ptp:ocp code path that reports an OCP board ID obtained from EEPROM. Exposure therefore requires use of that OCP PTP functionality and processing of the EEPROM board ID.
How can I verify that the fix is present without relying on a version number?
Inspect the ptp:ocp source for board-ID handling before devlink_info_version_fixed_put(). The board ID should be copied or formatted into the existing local buffer with a precision limit of at most OCP_BOARD_ID_LEN, rather than passing the EEPROM field directly as a C string.