The Linux kernel's net/ncsi subsystem had a vulnerability (CVE-2026-74694) where the function ncsi_send_cmd_nl() uses an attacker-controlled length field from the NCSI packet header to copy data without cross-checking against the actual netlink attribute size. This discrepancy allows an attacker with CAP_NET_ADMIN privileges to cause a heap out-of-bounds read by specifying a payload length larger than the netlink attribute's readable size, leaking up to ~64KB of kernel heap memory. The vulnerability does not cause a write overflow but results in an information leak. It affects systems with registered NCSI devices, such as OpenBMC on Aspeed BMC SoCs. The issue was found by Tencent Yunding Lab's autokbug dynamic kernel fuzzer. The fix involves rejecting commands whose declared payload length exceeds the data attribute size.

An attacker with CAP_NET_ADMIN privileges on a system with a registered NCSI device can exploit this vulnerability to leak sensitive kernel heap memory. This information leak could potentially aid further attacks or reconnaissance but does not directly allow code execution or privilege escalation. The vulnerability is limited to systems with the NET_NCSI feature enabled and a registered NCSI device.

A fix is available that rejects NCSI commands whose declared payload length extends beyond the actual netlink attribute data size. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, updating to a fixed kernel version is the recommended remediation. No additional mitigations are specified. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory or Linux kernel mailing lists for the exact fixed versions.