CVE-2026-46064: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46064 Overview

CVE-2026-46064 is a heap over-read vulnerability in the Linux kernel's ibmasm driver, which provides support for the IBM Advanced System Management (ASM) service processor. The flaw resides in the ibmasm_send_i2o_message() function, where get_dot_command_size() derives a byte count for memcpy_toio() from user-controlled header fields without validating them against the actual allocation size. A root user can supply a small buffer with inflated header values, causing the kernel to read up to roughly 65 KB past the end of the allocation and forward that adjacent heap memory to the service processor over MMIO.

Critical Impact
A privileged local user can leak up to ~65 KB of adjacent kernel heap memory to the IBM ASM service processor and desynchronize the SP through inconsistent I2O message frames.

Affected Products

Linux kernel ibmasm driver (IBM Advanced System Management interface)
Stable kernel branches receiving fixes via commits 9aad711, 9e8f6c9, c1c2417, fd19eb1, and fe31722
Systems exposing the ibmasm character device to privileged userspace

Discovery Timeline

2026-05-27 - CVE-2026-46064 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46064

Vulnerability Analysis

The ibmasm_send_i2o_message() function constructs an I2O message frame for the IBM ASM service processor using a dot_command_header populated from userspace. The header contains two attacker-controlled length fields: command_size (u8) and data_size (u16). The helper get_dot_command_size() combines these values to determine how many bytes memcpy_toio() should copy from the kernel-side buffer to the MMIO region.

Because the computed length is never compared against the buffer's actual allocation size, a root user can write a short buffer while declaring much larger header sizes. The memcpy_toio() call then reads beyond the allocation into adjacent kernel slab memory and transmits the out-of-bounds contents to the service processor. This constitutes an out-of-bounds read [CWE-125] and a potential kernel information disclosure channel through the MMIO interface.

Root Cause

The root cause is missing input validation on attacker-controlled length fields prior to a bulk memory copy. The driver trusts command_size and data_size from the user-supplied header without bounding them by the buffer length or by I2O_COMMAND_SIZE. Silently clamping the copy is insufficient: a clamped copy still produces a dot command whose header is inconsistent with the I2O message length, which can desynchronize the service processor.

A secondary correctness issue compounds the bug. Reading INBOUND_QUEUE_PORT via get_mfa_inbound() dequeues a hardware frame from the controller's free pool. If the function returns without a matching set_mfa_inbound() call after detecting an invalid size, the inbound frame pool is permanently exhausted.

Attack Vector

Exploitation requires local root privileges and access to the ibmasm device interface. An attacker submits a crafted I2O command whose dot_command_header declares a command_size and data_size larger than the underlying allocation. The kernel then performs memcpy_toio() across the inflated range, leaking neighboring heap memory to the service processor. The fixed code validates command_size before calling get_mfa_inbound(), rejects oversize requests, and clamps command_size to I2O_COMMAND_SIZE before the MMIO write so the copy stays within the I2O message frame.

No public proof-of-concept has been published. See the upstream fixes referenced in the Linux kernel stable tree for the exact validation logic.

Detection Methods for CVE-2026-46064

Indicators of Compromise

Unexpected use of the ibmasm character device by non-administrative workloads on IBM hardware platforms
Kernel log entries indicating rejected ibmasm I2O commands after applying the patched driver
Service processor desynchronization events or ibmasm inbound frame pool exhaustion warnings

Detection Strategies

Audit kernel package versions across IBM server fleets to identify hosts running pre-patch ibmasm builds
Monitor auditd for open() and write() syscalls against /dev/ibmasm* device nodes from unexpected processes
Correlate root-level process executions with subsequent ASM service processor errors reported via IPMI or BMC logs

Monitoring Recommendations

Track loaded kernel modules and flag environments where ibmasm is loaded but not required by the workload
Alert on privilege escalation chains that culminate in interaction with low-level hardware management drivers
Capture EDR telemetry on root-owned processes issuing ioctl or write operations against management controller devices

How to Mitigate CVE-2026-46064

Immediate Actions Required

Apply the upstream kernel fixes referenced by commits 9aad711, 9e8f6c9, c1c2417, fd19eb1, and fe31722
Restrict root access on IBM hardware that exposes the ibmasm interface
Inventory systems with the ibmasm module loaded and prioritize them for patch deployment

Patch Information

The fix validates command_size before calling get_mfa_inbound(), rejects requests whose header fields exceed the buffer or the I2O frame size, and clamps command_size to I2O_COMMAND_SIZE prior to memcpy_toio(). This prevents the heap over-read, avoids leaking inbound message frames, and keeps the MMIO write within bounds. Patches are available in the mainline and stable Linux kernel branches via the commits listed above.

Workarounds

Unload the ibmasm kernel module with rmmod ibmasm on systems that do not require IBM ASM service processor interaction
Blacklist the module in /etc/modprobe.d/ to prevent automatic loading on boot
Enforce least-privilege policies so that only trusted administrators retain root and access to /dev/ibmasm* nodes

bash

# Blacklist the ibmasm module to prevent loading
echo 'blacklist ibmasm' | sudo tee /etc/modprobe.d/disable-ibmasm.conf
sudo rmmod ibmasm 2>/dev/null || true
sudo update-initramfs -u