CVE-2026-46064

A flaw was found in the Linux kernel's ibmasm module. A local root user can exploit a heap over-read vulnerability within the ibmasm_send_i2o_message() function. This vulnerability arises from insufficient validation of user-controlled input sizes, allowing the system to read beyond allocated memory. Such an exploit could lead to the disclosure of sensitive kernel heap information and potentially cause the service processor to desynchronize, impacting overall system stability.

This vulnerability is rated as having a Moderate severity impact for Red Hat because successful exploitation requires local administrative privileges and relies on the presence of legacy IBM service processor hardware. The vulnerable ibmasm driver is not present or enabled across modern supported Red Hat Enterprise Linux releases, drastically limiting the operational blast radius. Consequently, default enterprise deployments are unaffected unless utilizing specialized legacy configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.