Vulnerability-Lookup

GHSA-3M5X-223V-JQ2M

Vulnerability from github – Published: 2026-08-15 15:30 – Updated: 2026-08-19 18:32

Details

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nzxt-smart2) DMA-align output buffer

Sashiko reports:

When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA.

When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation.

Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption.

Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74551"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T13:18:00Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nzxt-smart2) DMA-align output buffer\n\nSashiko reports:\n\nWhen send_output_report() calls hid_hw_output_report(), the underlying USB\nHID core calls usb_interrupt_msg() which maps this buffer directly for DMA.\n\nWhen the DMA mapping flushes or invalidates the cacheline, it will corrupt\nthe adjacent variables (mutex, update_interval) that were modified\nconcurrently by the CPU. This causes memory corruption due to cacheline\nsharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA\nAPI debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings\nfor this violation.\n\nAny operation that triggers send_output_report() (like setting a fan speed\nor updating the interval) causes the USB DMA mapping. On systems with\nnon-coherent caches, this structural bug causes immediate and deterministic\nmemory corruption.\n\nAlign the output buffer to ARCH_DMA_MINALIGN to fix the problem.",
  "id": "GHSA-3m5x-223v-jq2m",
  "modified": "2026-08-19T18:32:31Z",
  "published": "2026-08-15T15:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74551"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2332d35aaf206c17acf848522817252732596676"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6a2dbce5da2d2163a5b684acf68a0e54582ff0fa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/70ad543ce81f368411b6c721265a3b2d7ab4fda4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/81a6593b1c8dfb2694cd0ce39be01212d2b8436c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74551 (GCVE-0-2026-74551)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:38

Title

hwmon: (nzxt-smart2) DMA-align output buffer

Summary

In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) DMA-align output buffer Sashiko reports: When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA. When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation. Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption. Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/81a6593b1c8dfb269…
https://git.kernel.org/stable/c/70ad543ce81f36841…
https://git.kernel.org/stable/c/51a76bc1b8e717ee3…
https://git.kernel.org/stable/c/2332d35aaf206c17a…
https://git.kernel.org/stable/c/6a2dbce5da2d2163a…
https://git.kernel.org/stable/c/080bbf42faf77e648…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 81a6593b1c8dfb2694cd0ce39be01212d2b8436c (git) Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 70ad543ce81f368411b6c721265a3b2d7ab4fda4 (git) Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f (git) Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 2332d35aaf206c17acf848522817252732596676 (git) Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 6a2dbce5da2d2163a5b684acf68a0e54582ff0fa (git) Affected: 53e68c20aeb1e23419bed811aa3a309ceda200f9 , < 080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8 (git)
Linux	Linux	Affected: 5.17 Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/nzxt-smart2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81a6593b1c8dfb2694cd0ce39be01212d2b8436c",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "70ad543ce81f368411b6c721265a3b2d7ab4fda4",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "2332d35aaf206c17acf848522817252732596676",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "6a2dbce5da2d2163a5b684acf68a0e54582ff0fa",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            },
            {
              "lessThan": "080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8",
              "status": "affected",
              "version": "53e68c20aeb1e23419bed811aa3a309ceda200f9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/nzxt-smart2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nzxt-smart2) DMA-align output buffer\n\nSashiko reports:\n\nWhen send_output_report() calls hid_hw_output_report(), the underlying USB\nHID core calls usb_interrupt_msg() which maps this buffer directly for DMA.\n\nWhen the DMA mapping flushes or invalidates the cacheline, it will corrupt\nthe adjacent variables (mutex, update_interval) that were modified\nconcurrently by the CPU. This causes memory corruption due to cacheline\nsharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA\nAPI debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings\nfor this violation.\n\nAny operation that triggers send_output_report() (like setting a fan speed\nor updating the interval) causes the USB DMA mapping. On systems with\nnon-coherent caches, this structural bug causes immediate and deterministic\nmemory corruption.\n\nAlign the output buffer to ARCH_DMA_MINALIGN to fix the problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable send_output_report() path is reached by writing hwmon sysfs attributes (pwm*, update_interval) under /sys/class/hwmon/, a local interface. The USB stack only performs internal DMA mapping; the attacker does not need network, adjacent-network, or direct USB bus manipulation to trigger the bug.\nAC:L - On non-coherent ARM/MIPS systems, each sysfs write that triggers send_output_report() deterministically causes DMA cache-line operations that corrupt the adjacent mutex and update_interval; the attacker controls when writes occur and can repeat them at will with no race or grooming required.\nPR:L - The driver exposes pwm* and update_interval hwmon attributes with mode 0644 and performs no capability or credential checks on the write path; any unprivileged local user account can trigger send_output_report() without real root or init-namespace capabilities.\nUI:N - Exploitation requires only the attacker writing to hwmon sysfs on a system where the NZXT device is already present and bound; no victim action such as opening a file, clicking a prompt, or mounting a filesystem is needed beyond normal device presence at boot.\nS:U - Corruption is confined to kernel driver private data (mutex, update_interval) within the host kernel heap; impact is standard kernel memory corruption and potential privilege escalation, not crossing VM, container, or IOMMU security boundaries.\nC:H - DMA cache-line invalidation corrupts adjacent kernel structures including struct mutex while concurrently modified by the CPU; this class of heap-adjacent memory corruption is a general primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Corrupting an actively held struct mutex in kernel driver private data enables control of synchronization state and adjacent heap contents, providing an exploitable kernel memory corruption primitive suitable for arbitrary write and control-flow hijacking.\nA:H - Corrupted mutex and driver state cause immediate kernel instability including possible deadlock, oops, or panic on every triggering sysfs write on affected non-coherent architectures; the fix commit describes immediate and deterministic memory corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:47.362Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81a6593b1c8dfb2694cd0ce39be01212d2b8436c"
        },
        {
          "url": "https://git.kernel.org/stable/c/70ad543ce81f368411b6c721265a3b2d7ab4fda4"
        },
        {
          "url": "https://git.kernel.org/stable/c/51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2332d35aaf206c17acf848522817252732596676"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a2dbce5da2d2163a5b684acf68a0e54582ff0fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8"
        }
      ],
      "title": "hwmon: (nzxt-smart2) DMA-align output buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74551",
    "datePublished": "2026-08-15T12:27:58.237Z",
    "dateReserved": "2026-08-15T05:44:03.915Z",
    "dateUpdated": "2026-08-19T16:38:47.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-3M5X-223V-JQ2M

CVE-2026-74551 (GCVE-0-2026-74551)

Tags

Sightings

Nomenclature