{
  "cveId": "CVE-2026-74729",
  "url": "https://patchblox.com/security/cve/CVE-2026-74729",
  "summary": "CVE-2026-74729 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-74729, released September 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read  put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing with snoop_file_read(), which also consumes via kfifo_to_user(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so __kfifo_to_user()\u0027s clamp to (in - out) is ineffective and kfifo_copy_to_user() can attempt a copy_to_user() past the kmalloc-2k backing store:    usercopy: Kernel memory exposure attempt detected from SLUB object   \u0027kmalloc-2k\u0027 (offset 0, size 2049)!   kernel BUG at mm/usercopy.c!   Call trace:    usercopy_abort    __check_heap_object    __check_object_size    kfifo_copy_to_user    __kfifo_to_user    snoop_file_read    vfs_read  Serialize kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer).  Annotate @fifo with __guarded_by(\u0026lock) and opt the driver into context analysis so the compiler enforces that all fifo access holds the lock.",
  "published": "2026-08-22T16:16:48Z",
  "severity": "Moderate",
  "cvss": 6.3,
  "epss": 0.00189,
  "epssPercentile": 0.08599,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-74729",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-74729",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74729",
      "released": "2026-09-04T01:46:23Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.9-1",
      "fix": "DEBIAN-CVE-2026-74729",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74729",
      "released": "2026-09-04T01:46:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}