CVE-2026-74729: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74729 Overview

CVE-2026-74729 is a race condition in the Linux kernel's ASPEED Low Pin Count (LPC) snoop driver (drivers/soc/aspeed/aspeed-lpc-snoop.c). The put_fifo_with_discard() function operates as both producer and consumer on a kfifo, invoking kfifo_skip() and kfifo_put() from the interrupt request (IRQ) handler without synchronizing with snoop_file_read(). On symmetric multiprocessing (SMP) systems, concurrent access can drive the fifo's (in - out) delta beyond the ring buffer size, defeating __kfifo_to_user()'s clamp and causing copy_to_user() to read past the kmalloc-2k backing allocation.

Critical Impact
The flaw triggers a hardened usercopy abort and kernel BUG, exposing SLUB heap contents adjacent to the fifo buffer and producing a denial of service on affected Baseboard Management Controller (BMC) hosts.

Affected Products

Linux kernel with the aspeed-lpc-snoop SoC driver enabled
ASPEED BMC platforms (AST2400/AST2500/AST2600 family) using LPC snoop channels
OpenBMC and derivative distributions built on affected kernel revisions

Discovery Timeline

2026-08-22 - CVE-2026-74729 published to the National Vulnerability Database (NVD)
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74729

Vulnerability Analysis

The ASPEED LPC snoop driver captures host POST codes and other LPC I/O port writes into a per-channel kfifo that userspace drains via read(). The kfifo API is lockless only when there is a single producer and single consumer. This driver violates that contract: the IRQ path calls both kfifo_skip() (which advances the consumer index out) and kfifo_put() (which advances the producer index in), while the file read path concurrently calls kfifo_to_user(), which also advances out.

On SMP hardware the interleaving of these updates can produce an inconsistent view where (in - out) exceeds the ring capacity. __kfifo_to_user() uses this delta to clamp the copy length, so a corrupted delta lets kfifo_copy_to_user() request a copy_to_user() that walks past the kmalloc-2k slab object. The kernel's CONFIG_HARDENED_USERCOPY check in __check_heap_object() detects the out-of-bounds access and calls usercopy_abort(), terminating the task with a kernel BUG.

Root Cause

The defect is a concurrency error [CWE-362] combined with an out-of-bounds read [CWE-125]. The driver treated a multi-writer kfifo as if it satisfied the single-producer/single-consumer invariant assumed by the lockless kfifo implementation. No spinlock or atomic sequence protected the paired kfifo_skip()/kfifo_put() operations against a parallel kfifo_to_user().

Attack Vector

Exploitation requires a local process with permission to read() the snoop character device (typically /dev/aspeed-lpc-snoop*) while LPC snoop traffic is being generated from the host. A racing reader on an SMP BMC can force the pointer inconsistency, triggering the hardened usercopy abort and taking down the reader task. Depending on kernel configuration, adjacent SLUB memory contents may be exposed before the abort fires.

See the upstream fix at Linux Kernel Commit 131ab677b033 and the stable backport at Linux Kernel Commit 1acef6d85bfd for the exact code changes.

Detection Methods for CVE-2026-74729

Indicators of Compromise

Kernel log messages containing usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-2k'
kernel BUG at mm/usercopy.c panics with a call trace through kfifo_copy_to_user, __kfifo_to_user, and snoop_file_read
Unexpected termination of userspace processes reading /dev/aspeed-lpc-snoop* character devices on BMC hosts

Detection Strategies

Inventory BMC and OpenBMC systems running kernels that include aspeed-lpc-snoop but predate the fix commits 131ab677b033 and 1acef6d85bfd.
Monitor dmesg and centralized log pipelines for usercopy_abort and __check_heap_object stack frames sourced from the ASPEED driver.
Correlate BMC crash dumps or watchdog reboots with concurrent snoop reader activity to identify racing consumers.

Monitoring Recommendations

Ship kernel logs from BMCs into a centralized data lake and alert on any usercopy or mm/usercopy.c BUG signatures.
Track process launches that open /dev/aspeed-lpc-snoop* and flag unexpected readers outside sanctioned host-monitoring agents.
Enable CONFIG_HARDENED_USERCOPY and panic_on_warn in test fleets to surface the race before it reaches production BMCs.

How to Mitigate CVE-2026-74729

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 131ab677b033 and 1acef6d85bfd to affected BMC and OpenBMC images.
Restrict access to /dev/aspeed-lpc-snoop* to trusted host-monitoring daemons via file permissions and mandatory access control policy.
Rebuild and redeploy vendor BMC firmware once patched kernels are available from the platform vendor.

Patch Information

The fix serializes kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer). The @fifo member is annotated with __guarded_by(&lock), and the driver opts into compiler context analysis so all fifo access is statically verified to hold the lock. The changes are available in the mainline Linux tree and stable backport branches referenced above.

Workarounds

Disable the aspeed-lpc-snoop driver or unbind affected channels where host POST code capture is not required.
Limit BMC kernels to uniprocessor (UP) operation where feasible, reducing but not eliminating the race window.
Ensure only a single trusted consumer opens each snoop channel to minimize concurrent kfifo_to_user() calls.

bash

# Configuration example: restrict snoop device access and blacklist the module if unused
chown root:bmc-monitor /dev/aspeed-lpc-snoop*
chmod 0640 /dev/aspeed-lpc-snoop*

# Optionally prevent the module from loading on systems that do not need LPC snoop
echo 'blacklist aspeed-lpc-snoop' | sudo tee /etc/modprobe.d/aspeed-lpc-snoop.conf
sudo depmod -a