CVE-2026-89743: misc: nsm: bound the device-reported response length

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

misc: nsm: bound the device-reported response length

nsmsendrecvmsglocked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parserespraw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). The request path already floors its length in fillreqraw(); the response path lacks the symmetric check.

Clamp the stored length to the size of the response buffer. Well-behaved devices report no more than the posted buffer size, so conforming traffic is unaffected.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

What attacker control is required to trigger the out-of-bounds read?

An attacker needs control of, or the ability to cause faulty behavior from, the NSM device backend so it reports a virtqueue used-ring response length larger than the posted response buffer. The oversized reported length is then used when copying the response to user space.

2

Who is realistically exposed?

Systems using the Linux kernel NSM interface are exposed when their NSM backend is malicious or buggy and can return an oversized response length. Well-behaved devices that report no more than the posted buffer size do not trigger the issue.

3

What is the impact of successful exploitation?

The kernel can copy bytes beyond the fixed response buffer into user space, disclosing adjacent kernel heap data. The provided information describes an out-of-bounds read and information disclosure.

4

What is the mitigation if an update cannot be applied immediately?

Avoid using an untrusted or known-buggy NSM device backend, and ensure the backend does not report response lengths larger than the response buffer it was given. The fix clamps the stored response length to the response buffer size.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203