GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89743 (GCVE-0-2026-89743)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
misc: nsm: bound the device-reported response length
Summary
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parse_resp_raw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). The request path already floors its length in fill_req_raw(); the response path lacks the symmetric check. Clamp the stored length to the size of the response buffer. Well-behaved devices report no more than the posted buffer size, so conforming traffic is unaffected.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b9873755a6c8ccfce79094c4dce9efa3ecb1a749 , < 339f19b9a6171289b0e797deb8bda80b9a1fcc30 (git)
Affected: b9873755a6c8ccfce79094c4dce9efa3ecb1a749 , < 29e634a18957acda11383a15ab98a91c4ae9e294 (git)
Affected: b9873755a6c8ccfce79094c4dce9efa3ecb1a749 , < 2aa0fb9c96f894a9c179a48e7522ea6705800adf (git)
Affected: b9873755a6c8ccfce79094c4dce9efa3ecb1a749 , < 808e530654a5354e6df78863a5d61e4d44e67235 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/nsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "339f19b9a6171289b0e797deb8bda80b9a1fcc30",
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "versionType": "git"
            },
            {
              "lessThan": "29e634a18957acda11383a15ab98a91c4ae9e294",
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "versionType": "git"
            },
            {
              "lessThan": "2aa0fb9c96f894a9c179a48e7522ea6705800adf",
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "versionType": "git"
            },
            {
              "lessThan": "808e530654a5354e6df78863a5d61e4d44e67235",
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/nsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: nsm: bound the device-reported response length\n\nnsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported\nby the NSM device into msg-\u003eresp.len without bounding it to the response\nbuffer. A malicious or buggy backend can report a length larger than the\nresponse buffer; parse_resp_raw() then copies that many bytes out of the\nfixed buffer to user space, disclosing adjacent kernel heap (an\nout-of-bounds read). The request path already floors its length in\nfill_req_raw(); the response path lacks the symmetric check.\n\nClamp the stored length to the size of the response buffer. Well-behaved\ndevices report no more than the posted buffer size, so conforming traffic\nis unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A malicious or buggy virtio-nsm backend (hypervisor, QEMU virtio-nsm, or vhost-user device) over-reports the used-ring length consumed by nsm_sendrecv_msg_locked(); the path is local ioctl on /dev/nsm plus virtio, not a network protocol.\nAC:L - The backend deterministically sets the 32-bit used-ring length on each completion, and a local NSM_IOCTL_RAW caller supplies the response iovec that parse_resp_raw() uses as the other copy bound; no race or attacker-uncontrollable layout is required.\nPR:N - The driver registers /dev/nsm as mode 0666 and nsm_dev_ioctl() has no capable() check, so any local process can issue NSM_IOCTL_RAW; a malicious virtio backend also needs no guest credentials.\nUI:N - The attacker opens /dev/nsm and issues NSM_IOCTL_RAW from their own process (the ioctl does not cap response.len to NSM_RESPONSE_MAX_SIZE); no separate victim must mount, click, or otherwise interact.\nS:U - The out-of-bounds read and any resulting oops occur in the guest kernel that hosts the NSM frontend; this is device-to-guest impact, not a guest-to-host, IOMMU, or cross-VM escape.\nC:H - parse_resp_raw() copy_to_user() copies min(user_len, unbounded device len) from the 0x3000-byte resp-\u003edata array, so an over-reported length reads adjacent kmalloc heap and returns that kernel memory to userspace.\nI:N - The oversized copy writes only into the ioctl caller\u0027s userspace buffer; kernel memory is only read, with no out-of-bounds write, use-after-free, or control-flow hijack primitive.\nA:H - A device-chosen length up to 4GiB drives copy_to_user() past the nsm slab object into unmapped or guarded memory, causing a guest kernel oops or panic that can be repeated on every NSM request."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:52.757Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/339f19b9a6171289b0e797deb8bda80b9a1fcc30"
        },
        {
          "url": "https://git.kernel.org/stable/c/29e634a18957acda11383a15ab98a91c4ae9e294"
        },
        {
          "url": "https://git.kernel.org/stable/c/2aa0fb9c96f894a9c179a48e7522ea6705800adf"
        },
        {
          "url": "https://git.kernel.org/stable/c/808e530654a5354e6df78863a5d61e4d44e67235"
        }
      ],
      "title": "misc: nsm: bound the device-reported response length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89743",
    "datePublished": "2026-09-11T19:46:49.261Z",
    "dateReserved": "2026-09-11T19:38:34.761Z",
    "dateUpdated": "2026-09-13T06:33:52.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89743",
      "date": "2026-09-17",
      "epss": "0.00144",
      "percentile": "0.04033"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/misc/nsm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "339f19b9a6171289b0e797deb8bda80b9a1fcc30",
                    "status": "affected",
                    "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "29e634a18957acda11383a15ab98a91c4ae9e294",
                    "status": "affected",
                    "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2aa0fb9c96f894a9c179a48e7522ea6705800adf",
                    "status": "affected",
                    "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "808e530654a5354e6df78863a5d61e4d44e67235",
                    "status": "affected",
                    "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/misc/nsm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: nsm: bound the device-reported response length\n\nnsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported\nby the NSM device into msg-\u003eresp.len without bounding it to the response\nbuffer. A malicious or buggy backend can report a length larger than the\nresponse buffer; parse_resp_raw() then copies that many bytes out of the\nfixed buffer to user space, disclosing adjacent kernel heap (an\nout-of-bounds read). The request path already floors its length in\nfill_req_raw(); the response path lacks the symmetric check.\n\nClamp the stored length to the size of the response buffer. Well-behaved\ndevices report no more than the posted buffer size, so conforming traffic\nis unaffected."
          }
        ],
        "id": "CVE-2026-89743",
        "lastModified": "2026-09-13T07:17:38.953",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:20:04.997",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/29e634a18957acda11383a15ab98a91c4ae9e294"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2aa0fb9c96f894a9c179a48e7522ea6705800adf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/339f19b9a6171289b0e797deb8bda80b9a1fcc30"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/808e530654a5354e6df78863a5d61e4d44e67235"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:48:01+00:00",
      "cve": "CVE-2026-89743",
      "id": "CVE-2026-89743",
      "initial_release_date": "2026-09-11T19:46:49.261000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: NSM information disclosure via out-of-bounds read",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89743.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:23:20Z",
      "cve": "CVE-2026-89743",
      "id": "CVE-2026-89743",
      "initial_release_date": "2026-09-12T16:22:26Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89743",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89743.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.