CVE-2026-74729: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
In the Linux kernel, the following vulnerability has been resolved:
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread
putfifowithdiscard() acts as both producer and consumer on the kfifo: it calls kfifoskip() (advances out) and kfifoput() (advances in) from the IRQ handler without synchronizing with snoopfileread(), which also consumes via kfifotouser(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so kfifotouser()'s clamp to (in - out) is ineffective and kfifocopytouser() can attempt a copytouser() past the kmalloc-2k backing store:
usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-2k' (offset 0, size 2049)! kernel BUG at mm/usercopy.c! Call trace: usercopyabort checkheapobject checkobjectsize kfifocopytouser kfifotouser snoopfileread vfsread
Serialize kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer). Annotate @fifo with guardedby(&lock) and opt the driver into context analysis so the compiler enforces that all fifo access holds the lock.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using the Aspeed LPC snoop driver are affected when its FIFO is accessed concurrently by the interrupt handler and a userspace reader. The race is specifically described on SMP systems.
What must occur for the vulnerability to be triggered?
An interrupt-driven producer path must call put_fifo_with_discard() while snoop_file_read() is reading the same kfifo. The unsynchronized kfifo_skip()/kfifo_put() and kfifo_to_user() operations can corrupt the observed FIFO state and cause an oversized copy_to_user().
How can an administrator recognize a possible occurrence?
The kernel may report a usercopy violation involving a kmalloc-2k object, such as a copy size of 2049, followed by a kernel BUG at mm/usercopy.c. Stack traces can include kfifo_copy_to_user, __kfifo_to_user, snoop_file_read, and vfs_read.
What is the remediation?
Apply a kernel version containing the fix that serializes per-channel kfifo access with a shared spinlock between the IRQ handler and file reader. The referenced stable commits are 131ab677b03349a5ae48da8722ec7075b37ec66e and 1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f.