CVE-2026-46022

HIGH EPSS 3.1%
Published May 27, 20261mo ago · Modified Jun 17, 20262w ago
7.1 CVSS 3.1
High
Find Similar
Published May 27, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() ibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read when the queue reader or writer index from hardware exceeds REMOTE_QUEUE_SIZE (60). A compromised service processor can trigger this by writing an out-of-range value to the reader or writer MMIO register before asserting an interrupt. Since writer is re-read from hardware on every loop iteration, it can also be set to an out-of-range value after the loop has already started. The root cause is that get_queue_reader() and get_queue_writer() return raw readl() values that are passed directly into get_queue_entry(), which computes: queue_begin + reader * sizeof(struct remote_input) with no bounds check. This unchecked MMIO address is then passed to memcpy_fromio(), reading 8 bytes from unintended device registers. For sufficiently large values the address falls outside the PCI BAR mapping entirely, triggering a machine check exception. Fix by checking both indices against REMOTE_QUEUE_SIZE at the top of the loop body, before any call to get_queue_entry(). On an out-of-range value, reset the reader register to 0 via set_queue_reader() before breaking, so that normal queue operation can resume if the corrupted hardware state is transient.

CVSS Details

Base Score
7.1
Exploitability
1.8
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
3.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 7

VendorProductVersionRange
linuxlinux_kernel*≥2.6.13  –  <5.10.258
linuxlinux_kernel*≥5.11  –  <5.15.209
linuxlinux_kernel*≥5.16  –  <6.1.175
linuxlinux_kernel*≥6.2  –  <6.6.140
linuxlinux_kernel*≥6.7  –  <6.12.86
linuxlinux_kernel*≥6.13  –  <6.18.27
linuxlinux_kernel*≥6.19  –  <7.0.4

References 8

  • git.kernel.org https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b
    Patch