CVE-2026-45994 ibmasm: fix OOB reads in command_file_write due to missing size checks
An attacker can trigger out-of-bounds reads in the ibmasm driver to leak kernel heap memory to the service processor.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45994?
CVE-2026-45994 is a high-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ibmasm: fix OOB reads in command_file_write due to missing size checks
The command_file_write() handler allocates a kernel buffer of exactly count bytes and copies user data into it, but does not validate the buffer against the dot command protocol before passing it to get_dot_command_size() and get_dot_command_timeout().
Since both the allocation size (count) and the header fields (command_size, data_size) are independently user-controlled, an attacker can cause get_dot_command_size() to return a value exceeding the allocation, triggering OOB reads in get_dot_command_timeout() and an out-of-bounds memcpy_toio() that leaks kernel heap memory to the service processor.
Fix with two guards: reject writes smaller than sizeof(struct dot_command_header) before allocation, then after copying user data reject commands where the buffer is smaller than the total size declared by the header (sizeof(header) + command_size + data_size). This ensures all subsequent header and payload field accesses stay within the buffer.
Weakness: CWE-125
Which versions are affected by CVE-2026-45994?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45994?
Apply the vendor's patch.
Is CVE-2026-45994 being exploited?
There is no known exploitation of CVE-2026-45994 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88458, BELL-CVE-2026-45994, DEBIAN-CVE-2026-45994, GHSA-rcq2-mghh-wcf4, ROOT-OS-DEBIAN-11-CVE-2026-45994, ROOT-OS-DEBIAN-12-CVE-2026-45994 and 3 more.