CVE-2026-74729 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing with snoop_file_read(), which also consumes via kfifo_to_user(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp to (in - out) is ineffective and kfifo_copy_to_user() can attempt a copy_to_user() past the kmalloc-2k backing store:
usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-2k' (offset 0, size 2049)! kernel BUG at mm/usercopy.c! Call trace: usercopy_abort __check_heap_object __check_object_size kfifo_copy_to_user __kfifo_to_user snoop_file_read vfs_read
Serialize kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer). Annotate @fifo with __guarded_by(&lock) and opt the driver into context analysis so the compiler enforces that all fifo access holds the lock.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in the Linux kernel's Aspeed LPC snoop driver, specifically within the snoop_file_read function, represents a critical race condition leading to a usercopy overflow. This flaw stems from improper synchronization mechanisms when accessing a kernel FIFO (kfifo) structure that serves as both producer and consumer across different execution contexts. The core issue lies in the concurrent modification of the kfifo's internal pointers by two distinct entities: an interrupt handler acting as the producer via put_fifo_with_discard, which invokes kfifo_skip to advance the output pointer and kfifo_put to advance the input pointer, and a file read operation acting as the consumer via snoop_file_read, which utilizes kfifo_to_user. On symmetric multiprocessing systems where these operations can occur simultaneously without adequate locking, the mathematical difference between the input and output pointers can exceed the actual allocated size of the ring buffer. This discrepancy bypasses the safety clamps implemented within __kfifo_to_user, allowing the subsequent call to kfifo_copy_to_user to attempt a memory copy operation that extends beyond the bounds of the kmalloc-2k backing store.
The operational impact of this vulnerability is severe, manifesting as kernel memory exposure and potential system instability or crash. When the unchecked copy_to_user function attempts to read past the allocated buffer boundary, it triggers a usercopy abort mechanism within the kernel's mm/usercopy.c subsystem. This results in a kernel BUG being raised, effectively causing a denial of service through an oops or panic depending on configuration. Furthermore, because the overflow involves copying data from kernel space to user space without proper bounds checking, there is a risk that sensitive kernel memory contents adjacent to the buffer could be leaked to unprivileged userspace applications. This aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization Race Condition. The specific mechanism of exposing internal kernel state through a user-facing interface also touches upon aspects of information disclosure, though the primary vector is the buffer overflow itself.
From an offensive security perspective, this vulnerability can be leveraged to achieve arbitrary code execution or privilege escalation if an attacker can control the data being copied or exploit the resulting memory corruption for heap spraying techniques. The ATT&CK framework categorizes such exploitation under T1059 Command and Scripting Interpreter or potentially T1068 Exploitation for Privilege Escalation, depending on how the kernel panic is handled or if the overflow allows overwriting critical function pointers in adjacent slab objects. The detection of this issue relies on monitoring for usercopy abort messages in system logs, which serve as a clear indicator that an out-of-bounds access attempt has been intercepted by the kernel's security mechanisms before it could cause more catastrophic damage to memory integrity.
The resolution involves implementing strict serialization for all kfifo accesses using a per-channel spinlock shared between the interrupt handler and the file reader. This ensures mutual exclusion, preventing the race condition where the producer advances pointers faster than the consumer can safely read them or vice versa in a way that violates buffer bounds. Additionally, the fix incorporates static analysis annotations by marking the fifo structure with __guarded_by(&lock). This annotation opts the driver into context-sensitive type checking enforced by the compiler, ensuring that any future access to the FIFO data structure must hold the associated lock. This proactive measure not only fixes the immediate vulnerability but also prevents regression and similar issues in future code modifications by enforcing correct locking semantics at compile time rather than relying solely on runtime checks or developer discipline.