CyberSecBulletin
CVE-2026-46022NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-46022 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 6f6ecc9153df176e956d0664b56f93080b0a45f0, bac8643486f854dd53af9b23aea7dbbd9b7c1865, f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 6f6ecc9153df176e956d0664b56f93080b0a45f0 or bac8643486f854dd53af9b23aea7dbbd9b7c1865 or f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab or fc7e9a74e32299d7e93e178ca482a0b59ef1595b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.140, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux278d72ae8803ffcd16070c95fe1d53f4466dc741 up to, but not including, 6f6ecc9153df176e956d0664b56f93080b0a45f0; 278d72ae8803ffcd16070c95fe1d53f4466dc741 up to, but not including, bac8643486f854dd53af9b23aea7dbbd9b7c1865; 278d72ae8803ffcd16070c95fe1d53f4466dc741 up to, but not including, f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab; 278d72ae8803ffcd16070c95fe1d53f4466dc741 up to, but not including, fc7e9a74e32299d7e93e178ca482a0b59ef1595b; 278d72ae8803ffcd16070c95fe1d53f4466dc741 up to, but not including, 07c4f18b303106e6b24492c12b95d48a4b985841; 278d72ae8803ffcd16070c95fe1d53f4466dc741 up to, but not including, 22a16d3eafee92a165c756081587c95850127107; 278d72ae8803ffcd16070c95fe1d53f4466dc741 up to, but not including, 1ca75f6b74ec7f685464e5745ecfcf3a76d284e9; 278d72ae8803ffcd16070c95fe1d53f4466dc741 up to, but not including, 4b6e6ead556734bdc14024c5f837132b1e7a4b84; and 1 more ranges6f6ecc9153df176e956d0664b56f93080b0a45f0, bac8643486f854dd53af9b23aea7dbbd9b7c1865, f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab, fc7e9a74e32299d7e93e178ca482a0b59ef1595b, 07c4f18b303106e6b24492c12b95d48a4b985841, 22a16d3eafee92a165c756081587c95850127107
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel2.6.13 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.140; 6.7 up to, but not including, 6.12.86; 6.13 up to, but not including, 6.18.27; 6.19 up to, but not including, 7.0.45.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() ibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read when the queue reader or writer index from hardware exceeds REMOTE_QUEUE_SIZE (60). A compromised service processor can trigger this by writing an out-of-range value to the reader or writer MMIO register before asserting an interrupt. Since writer is re-read from hardware on every loop iteration, it can also be set to an out-of-range value after the loop has already started. The root cause is that get_queue_reader() and get_queue_writer() return raw readl() values that are passed directly into get_queue_entry(), which computes: queue_begin + reader * sizeof(struct remote_input) with no bounds check. This unchecked MMIO address is then passed to memcpy_fromio(), reading 8 bytes from unintended device registers. For sufficiently large values the address falls outside the PCI BAR mapping entirely, triggering a machine check exception. Fix by checking both indices against REMOTE_QUEUE_SIZE at the top of the loop body, before any call to get_queue_entry(). On an out-of-range value, reset the reader register to 0 via set_queue_reader() before breaking, so that normal queue operation can resume if the corrupted hardware state is transient.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.