GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74551 (GCVE-0-2026-74551)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:38
VLAI
Title
hwmon: (nzxt-smart2) DMA-align output buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) DMA-align output buffer Sashiko reports: When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA. When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation. Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption. Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 81a6593b1c8dfb2694cd0ce39be01212d2b8436c (git)
Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 70ad543ce81f368411b6c721265a3b2d7ab4fda4 (git)
Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f (git)
Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 2332d35aaf206c17acf848522817252732596676 (git)
Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 6a2dbce5da2d2163a5b684acf68a0e54582ff0fa (git)
Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/nzxt-smart2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81a6593b1c8dfb2694cd0ce39be01212d2b8436c",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "70ad543ce81f368411b6c721265a3b2d7ab4fda4",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "2332d35aaf206c17acf848522817252732596676",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "6a2dbce5da2d2163a5b684acf68a0e54582ff0fa",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/nzxt-smart2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nzxt-smart2) DMA-align output buffer\n\nSashiko reports:\n\nWhen send_output_report() calls hid_hw_output_report(), the underlying USB\nHID core calls usb_interrupt_msg() which maps this buffer directly for DMA.\n\nWhen the DMA mapping flushes or invalidates the cacheline, it will corrupt\nthe adjacent variables (mutex, update_interval) that were modified\nconcurrently by the CPU. This causes memory corruption due to cacheline\nsharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA\nAPI debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings\nfor this violation.\n\nAny operation that triggers send_output_report() (like setting a fan speed\nor updating the interval) causes the USB DMA mapping. On systems with\nnon-coherent caches, this structural bug causes immediate and deterministic\nmemory corruption.\n\nAlign the output buffer to ARCH_DMA_MINALIGN to fix the problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable send_output_report() path is reached by writing hwmon sysfs attributes (pwm*, update_interval) under /sys/class/hwmon/, a local interface. The USB stack only performs internal DMA mapping; the attacker does not need network, adjacent-network, or direct USB bus manipulation to trigger the bug.\nAC:L - On non-coherent ARM/MIPS systems, each sysfs write that triggers send_output_report() deterministically causes DMA cache-line operations that corrupt the adjacent mutex and update_interval; the attacker controls when writes occur and can repeat them at will with no race or grooming required.\nPR:L - The driver exposes pwm* and update_interval hwmon attributes with mode 0644 and performs no capability or credential checks on the write path; any unprivileged local user account can trigger send_output_report() without real root or init-namespace capabilities.\nUI:N - Exploitation requires only the attacker writing to hwmon sysfs on a system where the NZXT device is already present and bound; no victim action such as opening a file, clicking a prompt, or mounting a filesystem is needed beyond normal device presence at boot.\nS:U - Corruption is confined to kernel driver private data (mutex, update_interval) within the host kernel heap; impact is standard kernel memory corruption and potential privilege escalation, not crossing VM, container, or IOMMU security boundaries.\nC:H - DMA cache-line invalidation corrupts adjacent kernel structures including struct mutex while concurrently modified by the CPU; this class of heap-adjacent memory corruption is a general primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Corrupting an actively held struct mutex in kernel driver private data enables control of synchronization state and adjacent heap contents, providing an exploitable kernel memory corruption primitive suitable for arbitrary write and control-flow hijacking.\nA:H - Corrupted mutex and driver state cause immediate kernel instability including possible deadlock, oops, or panic on every triggering sysfs write on affected non-coherent architectures; the fix commit describes immediate and deterministic memory corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:47.362Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81a6593b1c8dfb2694cd0ce39be01212d2b8436c"
        },
        {
          "url": "https://git.kernel.org/stable/c/70ad543ce81f368411b6c721265a3b2d7ab4fda4"
        },
        {
          "url": "https://git.kernel.org/stable/c/51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2332d35aaf206c17acf848522817252732596676"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a2dbce5da2d2163a5b684acf68a0e54582ff0fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8"
        }
      ],
      "title": "hwmon: (nzxt-smart2) DMA-align output buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74551",
    "datePublished": "2026-08-15T12:27:58.237Z",
    "dateReserved": "2026-08-15T05:44:03.915Z",
    "dateUpdated": "2026-08-19T16:38:47.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74551",
      "date": "2026-09-10",
      "epss": "0.00129",
      "percentile": "0.02896"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:03:41.000Z",
      "cve": "CVE-2026-74551",
      "id": "msrc_CVE-2026-74551",
      "initial_release_date": "2026-08-23T15:03:41.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "hwmon: (nzxt-smart2) DMA-align output buffer",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74551.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74551\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:18:00.500\",\"lastModified\":\"2026-08-19T17:21:10.190\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (nzxt-smart2) DMA-align output buffer\\n\\nSashiko reports:\\n\\nWhen send_output_report() calls hid_hw_output_report(), the underlying USB\\nHID core calls usb_interrupt_msg() which maps this buffer directly for DMA.\\n\\nWhen the DMA mapping flushes or invalidates the cacheline, it will corrupt\\nthe adjacent variables (mutex, update_interval) that were modified\\nconcurrently by the CPU. This causes memory corruption due to cacheline\\nsharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA\\nAPI debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings\\nfor this violation.\\n\\nAny operation that triggers send_output_report() (like setting a fan speed\\nor updating the interval) causes the USB DMA mapping. On systems with\\nnon-coherent caches, this structural bug causes immediate and deterministic\\nmemory corruption.\\n\\nAlign the output buffer to ARCH_DMA_MINALIGN to fix the problem.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hwmon/nzxt-smart2.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"53e68c20aeb1e23419bed811aa3a309ceda200f9\",\"lessThan\":\"81a6593b1c8dfb2694cd0ce39be01212d2b8436c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"53e68c20aeb1e23419bed811aa3a309ceda200f9\",\"lessThan\":\"70ad543ce81f368411b6c721265a3b2d7ab4fda4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"53e68c20aeb1e23419bed811aa3a309ceda200f9\",\"lessThan\":\"51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"53e68c20aeb1e23419bed811aa3a309ceda200f9\",\"lessThan\":\"2332d35aaf206c17acf848522817252732596676\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"53e68c20aeb1e23419bed811aa3a309ceda200f9\",\"lessThan\":\"6a2dbce5da2d2163a5b684acf68a0e54582ff0fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"53e68c20aeb1e23419bed811aa3a309ceda200f9\",\"lessThan\":\"080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hwmon/nzxt-smart2.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2332d35aaf206c17acf848522817252732596676\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6a2dbce5da2d2163a5b684acf68a0e54582ff0fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/70ad543ce81f368411b6c721265a3b2d7ab4fda4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/81a6593b1c8dfb2694cd0ce39be01212d2b8436c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T19:39:54+00:00",
      "cve": "CVE-2026-74551",
      "id": "CVE-2026-74551",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hwmon: (nzxt-smart2) DMA-align output buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74551.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-21T00:39:36Z",
      "cve": "CVE-2026-74551",
      "id": "CVE-2026-74551",
      "initial_release_date": "2026-08-15T23:50:28Z",
      "product_status:known_affected": "100",
      "product_status:known_not_affected": "184",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74551",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74551.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.