CVE-2026-74729

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read<br /> <br /> put_fifo_with_discard() acts as both producer and consumer on the kfifo:<br /> it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from<br /> the IRQ handler without synchronizing with snoop_file_read(), which also<br /> consumes via kfifo_to_user(). On SMP systems this concurrent access can<br /> leave (in - out) larger than the ring buffer, so __kfifo_to_user()&amp;#39;s clamp<br /> to (in - out) is ineffective and kfifo_copy_to_user() can attempt a<br /> copy_to_user() past the kmalloc-2k backing store:<br /> <br /> usercopy: Kernel memory exposure attempt detected from SLUB object<br /> &amp;#39;kmalloc-2k&amp;#39; (offset 0, size 2049)!<br /> kernel BUG at mm/usercopy.c!<br /> Call trace:<br /> usercopy_abort<br /> __check_heap_object<br /> __check_object_size<br /> kfifo_copy_to_user<br /> __kfifo_to_user<br /> snoop_file_read<br /> vfs_read<br /> <br /> Serialize kfifo access with a per-channel spinlock shared between the<br /> IRQ handler (producer) and the file reader (consumer). Annotate @fifo<br /> with __guarded_by(&amp;lock) and opt the driver into context analysis so the<br /> compiler enforces that all fifo access holds the lock.