CVE-2026-45994

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ibmasm: fix OOB reads in command_file_write due to missing size checks

The command_file_write() handler allocates a kernel buffer of exactly

count bytes and copies user data into it, but does not validate the

buffer against the dot command protocol before passing it to

get_dot_command_size() and get_dot_command_timeout().

Since both the allocation size (count) and the header fields (command_size,

data_size) are independently user-controlled, an attacker can cause

get_dot_command_size() to return a value exceeding the allocation,

triggering OOB reads in get_dot_command_timeout() and an out-of-bounds

memcpy_toio() that leaks kernel heap memory to the service processor.

Fix with two guards: reject writes smaller than sizeof(struct

dot_command_header) before allocation, then after copying user data

reject commands where the buffer is smaller than the total size declared

by the header (sizeof(header) + command_size + da

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References