CVE-2026-74694
kernel: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 22, 2026
Updated · August 25, 2026
Description
A flaw was found in the Linux kernel's NCSI (Network Controller Sideband Interface) component. A local attacker with CAP_NET_ADMIN capabilities could exploit a heap out-of-bounds (OOB) read vulnerability. By crafting a malicious NCSI command with an oversized payload length, the attacker could cause the kernel to read past the intended buffer. This could lead to the disclosure of up to 64KB of sensitive kernel heap memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-125 · Out-of-bounds Read