PT-2026-43861 · Linux · Linux Kernel
CVE-2026-45994
·
Published
2026-05-27
·
Updated
2026-07-31
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 7.0.11-1.1
Description
An issue exists in the
command file write() handler where it allocates a kernel buffer based on a user-provided count but fails to validate this buffer against the dot command protocol before it is processed by get dot command size() and get dot command timeout(). Because the allocation size and header fields such as command size and data size are independently controlled by the user, it is possible to trigger out-of-bounds reads in get dot command timeout() and an out-of-bounds memcpy toio() operation, resulting in the leakage of kernel heap memory to the service processor.Recommendations
Update to version 7.0.11-1.1.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel