Usercopy Overflow Vulnerability in Aspeed LPC Snoop Driver for Linux Kernel

CVE-2026-74729

What is CVE-2026-74729?

A usercopy overflow vulnerability exists in the Aspeed LPC snoop driver of the Linux kernel. This flaw arises due to concurrent access between the IRQ handler and the file reader, which can lead to an attempt to copy data past the allocated kernel memory. Specifically, the issue is caused by the lack of proper synchronization when both kfifo_skip() and kfifo_put() are executed simultaneously. This can allow for unauthorized memory access, posing significant security risks. The issue has been addressed by serializing kfifo access with a dedicated spinlock and ensuring that all FIFO interactions are properly guarded to prevent potential exploits.

References