CVE-2026-89743: misc: nsm: bound the device-reported response length
In the Linux kernel, the following vulnerability has been resolved:
misc: nsm: bound the device-reported response length
nsmsendrecvmsglocked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parserespraw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). The request path already floors its length in fillreqraw(); the response path lacks the symmetric check.
Clamp the stored length to the size of the response buffer. Well-behaved devices report no more than the posted buffer size, so conforming traffic is unaffected.
Affected Software
Event History
Frequently Asked Questions
What attacker control is required to trigger the out-of-bounds read?
An attacker needs control of, or the ability to cause faulty behavior from, the NSM device backend so it reports a virtqueue used-ring response length larger than the posted response buffer. The oversized reported length is then used when copying the response to user space.
Who is realistically exposed?
Systems using the Linux kernel NSM interface are exposed when their NSM backend is malicious or buggy and can return an oversized response length. Well-behaved devices that report no more than the posted buffer size do not trigger the issue.
What is the impact of successful exploitation?
The kernel can copy bytes beyond the fixed response buffer into user space, disclosing adjacent kernel heap data. The provided information describes an out-of-bounds read and information disclosure.
What is the mitigation if an update cannot be applied immediately?
Avoid using an untrusted or known-buggy NSM device backend, and ensure the backend does not report response lengths larger than the response buffer it was given. The fix clamps the stored response length to the response buffer size.