{"apiVersion":"1.0","identifier":"CVE-2026-74729","description":"In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing with snoop_file_read(), which also consumes via kfifo_to_user(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so __kfifo_to_user()-s clamp to (in - out) is ineffective and kfifo_copy_to_user() can attempt a copy_to_user() past the kmalloc-2k backing store: usercopy: Kernel memory exposure attempt detected from SLUB object -kmalloc-2k- (offset 0, size 2049)! kernel BUG at mm/usercopy.c! Call trace: usercopy_abort __check_heap_object __check_object_size kfifo_copy_to_user __kfifo_to_user snoop_file_read vfs_read Serialize kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer). Annotate @fifo with __guarded_by(&lock) and opt the driver into context analysis so the compiler enforces that all fifo access holds the lock.","publishedAt":"2026-08-22T16:16:48","lastModifiedAt":"2026-08-22T16:16:48","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74729","cvssScore":null,"cvssVector":"Pending","epssProbability":0.0017,"riskScore":0,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74729","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74729","en":"https://www.redsauce.net/en/cves/CVE-2026-74729","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74729","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74729","de":"https://www.redsauce.net/de/cves/CVE-2026-74729","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74729","el":"https://www.redsauce.net/el/cves/CVE-2026-74729"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74729"}}