CVE-2026-74603 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: Fix board ID over-read
The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink_info_version_fixed_put() treats it as a C string and may read beyond the field.
Format at most OCP_BOARD_ID_LEN bytes into the existing local buffer before reporting the ID. Use a precision limit because the snprintf() output size alone does not bound the source string scan.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel driver for PTP over CPCI (ptp_ocp) contains a critical out-of-bounds read vulnerability arising from improper handling of fixed-length data structures within EEPROM board identification fields. The specific flaw occurs when the system attempts to report the board identifier through the devlink interface, which is commonly used by network management tools and administrators for hardware inventory and status monitoring. The underlying issue stems from treating a raw binary buffer as a null-terminated C string without verifying its termination state or length constraints before passing it to functions that expect standard string semantics.
The technical root cause lies in the interaction between the fixed-size EEPROM layout and the kernel's string processing routines. The board ID field is defined with a strict size of thirteen bytes, corresponding to OCP_BOARD_ID_LEN. However, this binary data does not necessarily include a NUL terminator at its end. When the driver passes this buffer directly to devlink_info_version_fixed_put(), which internally relies on snprintf() for formatting output into a local buffer, the function scans memory beyond the allocated thirteen-byte boundary in search of that missing null character. This behavior constitutes an out-of-bounds read, allowing the kernel to access arbitrary adjacent memory contents depending on what data resides immediately after the board ID field in EEPROM or system RAM.
This vulnerability is classified under CWE-126, which denotes a buffer over-read condition where software reads past the end of a buffer. From a threat modeling perspective aligned with MITRE ATT&CK techniques, this flaw facilitates information disclosure by potentially leaking sensitive kernel memory contents to user-space applications via the devlink netlink interface. An attacker or malicious local process could exploit this out-of-bounds read to gather intelligence about internal kernel structures, cryptographic keys, or other privileged data located in adjacent memory regions. While immediate exploitation for code execution is unlikely due to the read-only nature of the flaw, it significantly expands the attack surface by violating memory safety boundaries and providing unauthorized access to protected system information.
The operational impact includes potential instability if the accessed out-of-bounds memory contains unmapped pages or restricted permissions, which could trigger a kernel panic or segmentation fault in certain configurations. Even without crashing the system, consistent leakage of internal state can aid attackers in crafting more sophisticated exploits against other vulnerabilities present on the same host. The fix implemented addresses this by enforcing strict length limits during string formatting operations. Specifically, the solution utilizes precision specifiers within snprintf() calls to cap the number of bytes copied from the source buffer. This ensures that no matter whether a NUL terminator is present or absent, the operation remains confined strictly within the allocated thirteen-byte boundary, thereby eliminating the possibility of reading beyond the intended data structure.
To mitigate this risk and prevent similar issues in future development cycles, it is essential to enforce strict bounds checking whenever fixed-size binary buffers are converted into string representations for reporting purposes. Developers should avoid assuming null-termination in non-string data fields extracted from hardware registers or EEPROMs. Instead, explicit length parameters must always be passed to formatting functions like snprintf() using precision modifiers such as %.Ns syntax where N is the maximum allowable byte count. Additionally, integrating static analysis tools that detect potential over-read conditions on fixed-size buffers can help identify these patterns early in the software development lifecycle. Regular auditing of kernel drivers for proper memory boundary enforcement remains a critical component of maintaining system integrity and security posture against information disclosure attacks.