PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46064 Linux CVE debrief

A heap over-read vulnerability in the Linux kernel's ibmasm driver allows root users to trigger out-of-bounds reads of up to ~65 KB by supplying crafted dot_command_header values. The ibmasm_send_i2o_message() function uses get_dot_command_size() to compute memcpy_toio() byte counts from user-controlled command_size (u8) and data_size (u16) fields without validation against actual allocation size. This causes kernel heap memory to be read and forwarded to the service processor via MMIO. The fix validates command_size before dequeuing hardware frames to prevent I2O message frame exhaustion, rejects commands with inconsistent header fields to prevent SP desynchronization, and clamps command_size to I2O_COMMAND_SIZE before MMIO writes.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux on IBM server hardware with ASM service processors; kernel maintainers and distribution security teams responsible for stable kernel updates

Technical summary

The ibmasm driver for IBM Advanced Systems Management hardware contains a heap over-read in ibmasm_send_i2o_message(). The function derives memcpy_toio() length from user-supplied dot_command_header fields (command_size, data_size) without bounds checking. A root attacker can write a small buffer with inflated header values, causing up to ~65 KB of out-of-bounds kernel heap reads that are transmitted to the service processor. The vulnerability also risks I2O message frame exhaustion if validation occurs after hardware frame dequeuing. The fix implements three defenses: pre-validation of command_size before get_mfa_inbound() to prevent frame leaks, rejection of commands with header/buffer size mismatches to maintain SP synchronization, and clamping to I2O_COMMAND_SIZE for MMIO write bounds.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches when available
  • Restrict root access on systems using IBM ASM (Advanced Systems Management) hardware
  • Monitor for anomalous ibmasm driver activity or service processor communication failures
  • Review systems with ibmasm kernel module loaded for unauthorized access

Evidence notes

CVE description confirms root-privilege requirement and heap over-read mechanism. Kernel commit references indicate stable backports. No CVSS score assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46064 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46064

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46064 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46064

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9aad71144fa3682cca3837a06c8623016790e7ec

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9e8f6c9d4ecddda2f28baa1678340286cff3969c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c1c2417c60dbdca5ebb00462f21ee71c2d7f7083

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fd19eb1c75047a4ed4e855f56cafd704dc3914e0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fe31722b0194ff76bf8b461e8bf97a2081147787

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.