CVE-2026-89743: misc: nsm: bound the device-reported response length
In the Linux kernel, the following vulnerability has been resolved:
misc: nsm: bound the device-reported response length
nsmsendrecvmsglocked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parserespraw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). The request path already floors its length in fillreqraw(); the response path lacks the symmetric check.
Clamp the stored length to the size of the response buffer. Well-behaved devices report no more than the posted buffer size, so conforming traffic is unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel misc: nsm response path, clamp the device-reported response length stored in msg->resp.len to the size of the response buffer before parse_resp_raw() copies data to user space.
Event History
Frequently Asked Questions
What attacker control is required to trigger the out-of-bounds read?
An attacker needs control of, or the ability to cause faulty behavior from, the NSM device backend so it reports a virtqueue used-ring response length larger than the posted response buffer. The oversized reported length is then used when copying the response to user space.
Who is realistically exposed?
Systems using the Linux kernel NSM interface are exposed when their NSM backend is malicious or buggy and can return an oversized response length. Well-behaved devices that report no more than the posted buffer size do not trigger the issue.
What is the impact of successful exploitation?
The kernel can copy bytes beyond the fixed response buffer into user space, disclosing adjacent kernel heap data. The provided information describes an out-of-bounds read and information disclosure.
What is the mitigation if an update cannot be applied immediately?
Avoid using an untrusted or known-buggy NSM device backend, and ensure the backend does not report response lengths larger than the response buffer it was given. The fix clamps the stored response length to the response buffer size.