CVE-2026-46022 Overview
CVE-2026-46022 is a Linux kernel vulnerability in the ibmasm misc driver. The function ibmasm_handle_mouse_interrupt() performs an out-of-bounds memory-mapped I/O (MMIO) read when the queue reader or writer index supplied by hardware exceeds REMOTE_QUEUE_SIZE (60). A compromised IBM Advanced System Management (ASM) service processor can trigger the flaw by writing an out-of-range value to the reader or writer MMIO register before raising an interrupt. The resulting unchecked address is passed to memcpy_fromio(), which reads 8 bytes from unintended device registers or from outside the PCI Base Address Register (BAR) mapping, potentially raising a machine check exception.
Critical Impact
A malicious or malfunctioning service processor can force the kernel into reading memory outside the PCI BAR mapping, triggering a machine check exception and host denial of service.
Affected Products
- Linux kernel misc/ibmasm driver
- Systems running IBM hardware with the ASM service processor exposed to the kernel
- Stable Linux kernel branches receiving the referenced backport commits
Discovery Timeline
- 2026-05-27 - CVE-2026-46022 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46022
Vulnerability Analysis
The defect resides in ibmasm_handle_mouse_interrupt() within the ibmasm misc driver. The handler iterates over a remote input queue whose reader and writer indices live in MMIO registers controlled by the service processor. On each loop iteration, the driver re-reads the writer index from hardware, which means an attacker-controlled value can change mid-loop. Both indices flow into get_queue_entry() without validation, producing an MMIO address used directly by memcpy_fromio().
This is an out-of-bounds read [CWE-125] against device MMIO space rather than ordinary kernel memory. When indices remain near the legitimate range, the driver reads from unintended adjacent device registers. When indices are large enough to push the computed offset outside the PCI BAR mapping, the access faults, producing a machine check exception that can panic the host.
Root Cause
get_queue_reader() and get_queue_writer() return the raw values of readl() against MMIO registers. Those values are used as array indices in the expression queue_begin + reader * sizeof(struct remote_input) without any bounds check against REMOTE_QUEUE_SIZE. The driver implicitly trusts the service processor to supply valid indices.
Attack Vector
Exploitation requires a service processor capable of writing arbitrary values to the ibmasm reader or writer MMIO registers and asserting an interrupt to the host. A compromised, malfunctioning, or maliciously firmware-modified service processor can therefore induce out-of-bounds MMIO reads from the host kernel. Because the writer index is re-read on each iteration, the attacker can also flip the value to an out-of-range index after the loop begins.
The upstream fix validates both the reader and writer indices against REMOTE_QUEUE_SIZE at the top of every loop iteration, before calling get_queue_entry(). If either value is out of range, the patch calls set_queue_reader() to reset the reader register to 0 and then breaks out of the loop, allowing the driver to resume normal operation if the hardware state was only transiently corrupted. The fix is distributed across stable kernel commits 07c4f18b3031, 1ca75f6b74ec, 22a16d3eafee, 4b6e6ead5567, and fc7e9a74e322.
Detection Methods for CVE-2026-46022
Indicators of Compromise
- Machine check exceptions (MCE) on hosts using the ibmasm driver with no prior hardware fault history
- Unexpected kernel oops or panic traces referencing ibmasm_handle_mouse_interrupt, get_queue_entry, or memcpy_fromio
- Service processor firmware changes or anomalous interrupt rates from the ASM device
Detection Strategies
- Audit running kernel versions against the patched stable releases identified by the referenced git.kernel.org commits
- Monitor dmesg and mcelog for MCE entries correlated with ibmasm interrupts or PCI BAR access faults
- Inventory hosts loading the ibmasm module via lsmod and prioritize patch deployment on those systems
Monitoring Recommendations
- Forward kernel logs and MCE events to a central log platform and alert on stack traces involving ibmasm
- Track service processor firmware versions and integrity to identify potential compromise upstream of the host
- Baseline interrupt counters for the ASM device and alert on sudden deviations
How to Mitigate CVE-2026-46022
Immediate Actions Required
- Apply the stable kernel update containing the fix referenced by commits 07c4f18b3031, 1ca75f6b74ec, 22a16d3eafee, 4b6e6ead5567, and fc7e9a74e322
- On systems that do not require IBM ASM functionality, unload and blacklist the ibmasm module to remove the attack surface
- Verify the integrity and firmware version of any attached ASM service processors
Patch Information
The vulnerability is resolved upstream in the Linux kernel. Refer to the Kernel Git Commit 07c4f18b3031, Kernel Git Commit 1ca75f6b74ec, Kernel Git Commit 22a16d3eafee, Kernel Git Commit 4b6e6ead5567, and Kernel Git Commit fc7e9a74e322 for the backport applicable to your kernel branch. Rebuild and reboot affected hosts after applying the update.
Workarounds
- Blacklist the ibmasm kernel module on systems that do not require IBM service processor integration
- Restrict physical and management-network access to the ASM service processor to reduce the risk of firmware compromise
- Keep service processor firmware updated and validated against vendor-signed images
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
