# CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

> A local attacker with CAP_NET_ADMIN can trigger a heap out-of-bounds read in the Linux kernel NCSI driver, leaking up to 64KB of kernel memory.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 22 Aug 2026
- **Updated:** 22 Aug 2026
- **Also known as:** AZL-97140, BELL-CVE-2026-74694, DEBIAN-CVE-2026-74694, GHSA-9677-c9p4-rgm3, UBUNTU-CVE-2026-74694

## What is CVE-2026-74694?

CVE-2026-74694 is a vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

ncsi_send_cmd_nl() takes the number of bytes to copy from the
attacker-controlled ncsi_pkt_hdr.length field of the in-band packet
header, while the source buffer is the NCSI_ATTR_DATA netlink
attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).
The two length sources are never cross-checked: only
nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.

With hdr->length set larger than the attribute payload (up to 65535
against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies
past the end of the netlink attribute buffer with unsafe_memcpy(),
leaking up to ~64KB of kernel heap memory into the transmitted NCSI
command packet. The destination skb is sized by the declared payload,
so the write side does not overflow - this is a pure OOB read /
information leak, reachable with CAP_NET_ADMIN on systems with a
registered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where
NET_NCSI=y is standard).

Reject commands whose declared payload extends past the end of the
data attribute.

The issue was found by the autokbug dynamic kernel fuzzer at Tencent
Yunding Lab.

## Which versions are affected by CVE-2026-74694?


## How do I fix CVE-2026-74694?

Apply the vendor's patch.

## Is CVE-2026-74694 being exploited?

There is no known exploitation of CVE-2026-74694 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-74694 and fix it if it is affected.

What it is: CVE-2026-74694 is a vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-74694 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-74694/ (Markdown: https://insights.sbomify.com/CVE-2026-74694/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-74694
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74694
- OSV: https://osv.dev/vulnerability/CVE-2026-74694

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-74694/
Summaries are generated and may contain mistakes; the official description above is the record.