CVE-2026-74603: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74603 Overview

CVE-2026-74603 is an out-of-bounds read vulnerability in the Linux kernel's ptp_ocp driver, which supports Open Compute Project (OCP) Precision Time Protocol (PTP) hardware. The flaw resides in the driver's handling of the EEPROM board ID field. The board ID is a fixed 13-byte field that is not guaranteed to contain a NUL terminator. The driver passes this buffer directly to devlink_info_version_fixed_put(), which treats the input as a C string and may read past the end of the field.

Critical Impact
A local, low-privileged user can trigger an out-of-bounds memory read through devlink queries against the affected PTP device, potentially disclosing adjacent kernel memory or causing a denial-of-service condition.

Affected Products

Linux kernel builds that include the ptp_ocp driver (drivers/ptp/ptp_ocp.c)
Distributions shipping vulnerable stable kernel branches prior to the fixing commits
Systems using Open Compute Project timing cards exposed via devlink

Discovery Timeline

2026-08-22 - CVE-2026-74603 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74603

Vulnerability Analysis

The ptp_ocp driver reports firmware and hardware version metadata to userspace through the kernel devlink interface. Among the reported fields is the board ID read from onboard EEPROM. The EEPROM layout defines this field as exactly OCP_BOARD_ID_LEN (13) bytes, with no requirement that the content be NUL-terminated.

The driver passed the raw 13-byte buffer to devlink_info_version_fixed_put(), an API that expects a NUL-terminated C string. When the board ID contains no terminator within the field, string scanning routines such as strlen() and format specifiers such as %s read beyond the intended bounds. The read may cross into adjacent kernel memory until an incidental zero byte is encountered.

The upstream fix formats at most OCP_BOARD_ID_LEN bytes into an existing local buffer before reporting the ID, and applies a precision limit to the snprintf() format specifier. The precision limit is required because the destination size argument to snprintf() alone does not bound how far the source string is scanned.

Root Cause

The root cause is an improper assumption that a fixed-length binary field is a NUL-terminated string [CWE-125: Out-of-bounds Read]. The driver conflated buffer size with string length, allowing string-oriented consumers to read past the field boundary.

Attack Vector

Exploitation requires local access with sufficient privileges to query devlink information for the affected device. An attacker with the required access can trigger the out-of-bounds read by issuing devlink dev info requests. The impact aligns with a high-confidentiality, high-availability, no-integrity outcome: kernel memory disclosure or kernel instability, without direct memory corruption.

No verified public exploit code exists for this issue. The vulnerability is described in the upstream commit messages referenced by the NVD entry. See the ptp_ocp fix commit for the corrected buffer handling logic.

Detection Methods for CVE-2026-74603

Indicators of Compromise

Unexpected devlink dev info invocations from unprivileged or non-administrative user contexts targeting ptp_ocp devices
Kernel log entries referencing ptp_ocp, KASAN out-of-bounds read reports, or slab-out-of-bounds warnings tied to devlink_info_version_fixed_put
Anomalous access patterns to /sys/class/ptp/ and related devlink netlink sockets by non-timekeeping processes

Detection Strategies

Enable KASAN in test and pre-production kernels to surface the out-of-bounds read at runtime during driver initialization and devlink queries
Audit installed kernel package versions against the fixing commits published on git.kernel.org for each stable branch
Correlate audit logs for netlink operations targeting the devlink family against process identity and expected administrative activity

Monitoring Recommendations

Track kernel version inventory across hosts that expose OCP timing hardware and flag builds that predate the referenced stable commits
Alert on repeated devlink info queries from the same non-root user or short-lived process
Forward kernel ring buffer entries containing ptp_ocp or KASAN strings to centralized logging for review

How to Mitigate CVE-2026-74603

Immediate Actions Required

Update to a Linux kernel release that includes one of the fixing commits: 3d965811, 5fd91dd4, 6b69f2ef, 72ef3ce8, f8d7e575, or f92558bb
Prioritize hosts that load the ptp_ocp driver, including systems with Open Compute Project timing cards used for network time distribution
Restrict CAP_NET_ADMIN and devlink access to trusted administrators until patched kernels are deployed

Patch Information

The fix is present in upstream Linux stable branches through the commits listed in the NVD external references. Vendors backport these commits into distribution kernels. Review the following upstream references for exact patch content: Kernel Git Commit 72ef3ce, Kernel Git Commit f8d7e57, and Kernel Git Commit f92558b. Additional stable-tree backports are available at 3d965811, 5fd91dd4, and 6b69f2ef.

Workarounds

Blacklist the ptp_ocp module on systems that do not require OCP timing hardware to eliminate the vulnerable code path
Limit devlink access to root by tightening netlink permissions and administrative group membership
Remove or unbind affected timing cards from hosts until patched kernels are installed where operationally acceptable

bash

# Verify whether the ptp_ocp module is loaded
lsmod | grep ptp_ocp

# Prevent the module from loading until the kernel is patched
echo 'blacklist ptp_ocp' | sudo tee /etc/modprobe.d/blacklist-ptp_ocp.conf
sudo depmod -a

# Confirm installed kernel version against fixed stable release
uname -r