PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45994 Linux CVE debrief

CVE-2026-45994 is a vulnerability in the Linux kernel's ibmasm driver that could allow out-of-bounds memory reads and information disclosure. The command_file_write() handler failed to validate user-supplied buffer sizes against the dot command protocol header before processing. An attacker with local access could craft malicious input causing get_dot_command_size() to return values exceeding the allocated buffer, leading to out-of-bounds reads in get_dot_command_timeout() and subsequent memcpy_toio() operations that leak kernel heap memory to the service processor. The fix implements two validation guards: rejecting writes smaller than sizeof(struct dot_command_header) before allocation, then after copying user data, rejecting commands where the buffer is smaller than the total declared size (sizeof(header) + command_size + data_size). This vulnerability was published on 2026-05-27 and affects the Linux kernel ibmasm driver. Multiple stable kernel branches have received patches. Organizations running affected kernel versions with the ibmasm driver enabled should prioritize patching, particularly on systems where untrusted users have local access.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators running kernels with ibmasm driver enabled, particularly on IBM server hardware with Advanced Systems Management capabilities. Security teams managing multi-user Linux environments where untrusted local access is possible. Organizations with compliance requirements for kernel security patching.

Technical summary

The ibmasm driver's command_file_write() function in the Linux kernel failed to validate buffer sizes against the dot command protocol structure. The function allocates a kernel buffer of exactly 'count' bytes from user input without checking minimum header size requirements. After copying user data, it passes the buffer to get_dot_command_size() and get_dot_command_timeout() which read header fields (command_size, data_size) without bounds verification. Since both the allocation size and header fields are attacker-controlled, a malicious user can cause out-of-bounds memory reads and leak kernel heap contents to the service processor via memcpy_toio(). The vulnerability is local-only, requiring ability to write to the ibmasm device interface.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Review systems with ibmasm driver enabled, particularly those allowing untrusted local access
  • Consider disabling ibmasm driver if IBM ASM (Advanced Systems Management) hardware is not in use
  • Monitor distribution security advisories for backported fixes
  • Validate kernel version after patching to confirm fix deployment

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Patch commits identified in kernel.org stable repositories. Vendor identification marked as low confidence requiring review due to 'Unknown Vendor' classification in source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45994 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45994

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45994 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45994

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0eb09f737428e482a32a2e31e5e223f2b35a71d3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a672682d39dd34e2b5ba4feb436723bed65125ff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/aefc1a97da17d8309974690c8a03e439a91ebb1c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d0fb4d1dc43f8d5179917a2daaa82680993d4cdf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ee5737891464030a189837467df3b81a273718ad

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.