CVE-2026-74729

A flaw was found in the Linux kernel's Aspeed Low Pin Count (LPC) snoop driver. This vulnerability arises from a lack of synchronization during concurrent access to a kernel First-In, First-Out (kfifo) buffer. A local attacker could exploit this by triggering a race condition, leading to a usercopy overflow. This could result in kernel memory exposure, potentially disclosing sensitive information, and may also cause a system crash (Denial of Service).

A moderate-impact flaw was found in the upstream Linux kernel's Aspeed Low Pin Count (LPC) snoop driver. The driver's interrupt handler (put_fifo_with_discard) and its character-device read path (snoop_file_read) concurrently access the same kfifo ring buffer without synchronization; on SMP systems this race can leave the computed fifo length larger than the actual buffer, so a read can attempt to copy kernel memory past the end of the kmalloc-2k backing store. A local attacker able to read the LPC snoop device file while snoop interrupts are being handled could exploit this race condition to trigger a usercopy overflow, potentially exposing kernel memory and causing a kernel BUG that crashes the system (denial of service). Red Hat Product Security rates this flaw Moderate, with primary impact to system availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code is not present in Red Hat's shipped kernel packages, so Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (including the kernel-rt variants) and Red Hat In-Vehicle OS kernels are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.