CVE-2026-74551 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (nzxt-smart2) DMA-align output buffer
Sashiko reports:
When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA.
When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation.
Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption.
Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides within the Linux kernel's hardware monitoring subsystem, specifically affecting the nzxt-smart2 driver that manages NZXT smart device hardware. The issue demonstrates a classic cache coherency problem that occurs when handling DMA operations on non-coherent CPU architectures. The flaw manifests during the execution of send_output_report() function which invokes hid_hw_output_report(), ultimately leading to usb_interrupt_msg() calls within the USB HID core. This sequence creates a scenario where kernel memory buffers are directly mapped for DMA operations without proper alignment considerations, resulting in critical memory corruption vulnerabilities.
The technical root cause stems from improper buffer alignment when the kernel's DMA subsystem processes hardware communication requests. When the DMA mapping flushes or invalidates cache lines containing the output buffer, adjacent kernel variables including mutex locks and update_interval fields become corrupted due to shared cache line behavior on non-coherent architectures such as ARM and MIPS processors. This represents a fundamental violation of memory access patterns that should maintain cache coherency between CPU and DMA operations. The vulnerability is classified under CWE-1280 as an improper alignment of memory regions during DMA operations, specifically targeting the failure to account for cache line boundaries in memory allocation for hardware interfaces.
The operational impact of this vulnerability is severe and deterministic, affecting any system utilizing the nzxt-smart2 hardware monitoring driver. Every operation that triggers send_output_report() including fan speed adjustments or interval updates will immediately corrupt kernel memory structures on non-coherent CPU platforms. This creates a reliable path for both system instability and potential privilege escalation attacks since corrupted mutex locks could lead to race conditions and compromised synchronization primitives. The vulnerability is particularly dangerous because it operates at the kernel level where memory corruption can compromise entire system security boundaries.
The fix implemented addresses this through proper buffer alignment using ARCH_DMA_MINALIGN constants, ensuring that output buffers are aligned to the minimum DMA alignment requirements for the target architecture. This approach directly resolves the cache line sharing issue by preventing adjacent kernel variables from residing within the same cache line as the DMA-mapped buffer. The solution aligns with industry standards for kernel memory management and DMA handling practices while maintaining compatibility across different CPU architectures. System administrators should ensure that all affected Linux kernels are updated to versions containing this fix, particularly on embedded systems or servers utilizing ARM or MIPS processors where non-coherent caches are prevalent. The vulnerability demonstrates the critical importance of adhering to DMA API best practices and proper memory alignment when developing kernel drivers for hardware monitoring interfaces.
This issue relates to ATT&CK technique T1068 which involves the exploitation of legitimate credentials through privilege escalation pathways, as memory corruption can lead to unauthorized access to protected kernel resources. The vulnerability also connects to T1547 which addresses kernel-level persistence mechanisms that could be exploited if the memory corruption leads to unstable system behavior allowing for further attack vectors. The fix implementation follows standard security engineering practices by ensuring proper buffer alignment and cache coherency management in kernel space operations, preventing the type of deterministic corruption patterns that could enable sophisticated exploitation techniques.