CVE-2026-74551 is a vulnerability in Linux Kernel
Published on August 15, 2026
hwmon: (nzxt-smart2) DMA-align output buffer
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (nzxt-smart2) DMA-align output buffer
Sashiko reports:
When send_output_report() calls hid_hw_output_report(), the underlying USB
HID core calls usb_interrupt_msg() which maps this buffer directly for DMA.
When the DMA mapping flushes or invalidates the cacheline, it will corrupt
the adjacent variables (mutex, update_interval) that were modified
concurrently by the CPU. This causes memory corruption due to cacheline
sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA
API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings
for this violation.
Any operation that triggers send_output_report() (like setting a fan speed
or updating the interval) causes the USB DMA mapping. On systems with
non-coherent caches, this structural bug causes immediate and deterministic
memory corruption.
Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.
Products Associated with CVE-2026-74551
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 53e68c20aeb1e23419bed811aa3a309ceda200f9 and below 70ad543ce81f368411b6c721265a3b2d7ab4fda4 is affected.
- Version 53e68c20aeb1e23419bed811aa3a309ceda200f9 and below 51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f is affected.
- Version 53e68c20aeb1e23419bed811aa3a309ceda200f9 and below 2332d35aaf206c17acf848522817252732596676 is affected.
- Version 53e68c20aeb1e23419bed811aa3a309ceda200f9 and below 6a2dbce5da2d2163a5b684acf68a0e54582ff0fa is affected.
- Version 53e68c20aeb1e23419bed811aa3a309ceda200f9 and below 080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8 is affected.
- Version 5.17 is affected.
- Before 5.17 is unaffected.
- Version 6.6.151, <= 6.6.* is unaffected.
- Version 6.12.103, <= 6.12.* is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2-rc6, <= * is unaffected.