CVE-2026-74551

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nzxt-smart2) DMA-align output buffer

Sashiko reports:

When send_output_report() calls hid_hw_output_report(), the underlying USB

HID core calls usb_interrupt_msg() which maps this buffer directly for DMA.

When the DMA mapping flushes or invalidates the cacheline, it will corrupt

the adjacent variables (mutex, update_interval) that were modified

concurrently by the CPU. This causes memory corruption due to cacheline

sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA

API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings

for this violation.

Any operation that triggers send_output_report() (like setting a fan speed

or updating the interval) causes the USB DMA mapping. On systems with

non-coherent caches, this structural bug causes immediate and deterministic

memory corruption.

Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References