CVE-2026-74603

A flaw was found in the Linux kernel's ptp: ocp module. This vulnerability occurs because the EEPROM board ID, a fixed-size field, is not guaranteed to be null-terminated. When this ID is processed as a C string, it may lead to an over-read beyond its intended memory boundary. This memory corruption could result in information disclosure.

This vulnerability is rated as Moderate because exploitation requires local access and specialized hardware to trigger an out-of-bounds read, limiting the potential impact to local kernel memory disclosure or denial of service rather than arbitrary code execution. In typical enterprise environments, the ptp_ocp driver is only utilized when OpenCompute Project TimeCard network devices are physically attached and configured. Furthermore, the vulnerable code is not included in supported Red Hat Enterprise Linux releases, preventing exposure on standard installations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.