CVE-2026-74729: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-74729 is a usercopy overflow vulnerability in the Linux kernel's Aspeed LPC snoop driver (soc/aspeed/lpc-snoop), specifically in the snoop_file_read function. It affects Linux kernel versions from 4.19 onward, with fixes available in kernel 7.1.9 (for the 7.1.x stable branch) and 7.2. The vulnerability was published on August 22, 2026, and a patch was added to the GitHub Advisory Database (GHSA-6hj9-w6w6-x26p) the same day. No official CVSS score has been assigned by NVD yet; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is a race condition (concurrent unsynchronized access to a shared data structure) in the put_fifo_with_discard() function, which acts as both producer and consumer on the kfifo ring buffer. On SMP systems, put_fifo_with_discard() calls kfifo_skip() (advancing the out pointer) and kfifo_put() (advancing the in pointer) from the IRQ handler without synchronizing with snoop_file_read(), which concurrently consumes data via kfifo_to_user(). This race can cause the internal kfifo state (in - out) to exceed the actual ring buffer size, bypassing the bounds clamp in __kfifo_to_user() and allowing kfifo_copy_to_user() to attempt a copy_to_user() beyond the kmalloc-2k backing store — exposing up to 2049 bytes of kernel heap memory. The fix serializes kfifo access with a per-channel spinlock shared between the IRQ handler and the file reader, and annotates the fifo field with __guarded_by(&lock) for compiler-enforced locking (GitHub Advisory, Feedly).

A local user with read access to the LPC snoop device file can trigger this vulnerability by reading from the snoop file, causing the kernel to attempt a memory copy beyond the allocated kmalloc-2k buffer. This results in kernel memory exposure of up to 2049 bytes from the kernel heap (SLUB object), which may disclose sensitive kernel data. On systems with usercopy hardening enabled, the kernel will BUG and panic (kernel BUG at mm/usercopy.c), causing a denial of service. The vulnerability is limited to systems using Aspeed BMC SoCs with the LPC snoop driver loaded (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access to the LPC snoop device, limiting the attack surface to users or processes with permissions to read the snoop device file on affected Aspeed BMC systems (Feedly, GitHub Advisory).

• Logs: Kernel log entries containing usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-2k' or kernel BUG at mm/usercopy.c.
• Logs: Kernel call trace including usercopy_abort, __check_heap_object, __check_object_size, kfifo_copy_to_user, __kfifo_to_user, snoop_file_read, vfs_read.
• Process: Unusual or repeated reads from the LPC snoop device file (e.g., /dev/aspeed-lpc-snoop*) by unprivileged or unexpected processes.
• System: Unexpected kernel panics or system reboots on Aspeed BMC hardware, particularly on SMP-capable systems running the aspeed-lpc-snoop driver.

Apply the upstream kernel patches fixing commit 131ab677b03349a5ae48da8722ec7075b37ec66e (stable branch) or 1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f. Fixed kernel versions include 7.1.9 (for the 7.1.x series) and 7.2 and later. As a workaround where immediate patching is not possible, restrict access to the LPC snoop device files to trusted users and processes only, reducing the local attack surface (GitHub Advisory, Feedly).