UBUNTU-CVE-2026-74603: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlinkinfoversionfixedput() treats it as a C string and may read beyond the field. Format at most OCPBOARDIDLEN bytes into the existing local buffer before reporting the ID. Use a precision limit because the snprintf() output size alone does not bound the source string scan.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Format at most OCP_BOARD_ID_LEN bytes from the EEPROM board ID into the existing local buffer before reporting the ID, using a precision limit so snprintf() does not scan beyond the fixed 13-byte field.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop kernel packages. Exposure requires the PTP OCP driver's board-ID reporting path to handle an EEPROM board ID that lacks a NUL terminator.
What access would an attacker need?
The supplied severity vector indicates local attack access, low attack complexity, low privileges required, and no user interaction. The reported impact is high confidentiality and availability impact, with no integrity impact.
What does the fix change?
The fix bounds board-ID formatting to the fixed 13-byte EEPROM field before the value is passed to devlink information reporting. This prevents the code from scanning beyond the board-ID field when it is not NUL-terminated.