CVE-2026-46064

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ibmasm: fix heap over-read in ibmasm_send_i2o_message()<br /> <br /> The ibmasm_send_i2o_message() function uses get_dot_command_size() to<br /> compute the byte count for memcpy_toio(), but this value is derived from<br /> user-controlled fields in the dot_command_header (command_size: u8,<br /> data_size: u16) and is never validated against the actual allocation size.<br /> A root user can write a small buffer with inflated header fields, causing<br /> memcpy_toio() to read up to ~65 KB past the end of the allocation into<br /> adjacent kernel heap, which is then forwarded to the service processor<br /> over MMIO.<br /> <br /> Silently clamping the copy size is not sufficient: if the header fields<br /> claim a larger size than the buffer, the SP receives a dot command whose<br /> own header is inconsistent with the I2O message length, which can cause<br /> the SP to desynchronize. Reject such commands outright by returning<br /> failure.<br /> <br /> Validate command_size before calling get_mfa_inbound() to avoid leaking<br /> an I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware<br /> frame from the controller&amp;#39;s free pool, and returning without a<br /> corresponding set_mfa_inbound() call would permanently exhaust it.<br /> <br /> Additionally, clamp command_size to I2O_COMMAND_SIZE before the<br /> memcpy_toio() so the MMIO write stays within the I2O message frame,<br /> consistent with the clamping already performed by outgoing_message_size()<br /> for the header field.