CVE-2026-46064

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ibmasm: fix heap over-read in ibmasm_send_i2o_message()

The ibmasm_send_i2o_message() function uses get_dot_command_size() to

compute the byte count for memcpy_toio(), but this value is derived from

user-controlled fields in the dot_command_header (command_size: u8,

data_size: u16) and is never validated against the actual allocation size.

A root user can write a small buffer with inflated header fields, causing

memcpy_toio() to read up to ~65 KB past the end of the allocation into

adjacent kernel heap, which is then forwarded to the service processor

over MMIO.

Silently clamping the copy size is not sufficient: if the header fields

claim a larger size than the buffer, the SP receives a dot command whose

own header is inconsistent with the I2O message length, which can cause

the SP to desynchronize. Reject such commands outright by returning

failure.

Validate command_size before calling get_mfa_inbound() to avoid l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References