The Linux kernel's aspeed soc LPC snoop driver had a usercopy overflow vulnerability in snoop_file_read due to unsynchronized concurrent access to a kfifo buffer by the IRQ handler and file reader on SMP systems. The IRQ handler acts as both producer and consumer, calling kfifo_skip and kfifo_put without synchronization with snoop_file_read, which consumes via kfifo_to_user. This race condition can cause the (in - out) index difference to exceed the ring buffer size, making __kfifo_to_user's clamp ineffective and leading to an out-of-bounds copy_to_user call past the kmalloc-2k backing store. This results in kernel memory exposure attempts and kernel BUGs. The patch serializes kfifo access with a per-channel spinlock and annotates the fifo with __guarded_by to enforce locking at compile time.

The vulnerability can cause kernel memory exposure attempts and kernel crashes due to out-of-bounds usercopy operations. This could lead to system instability or potential information leakage from kernel memory. No known exploits in the wild have been reported.

A fix is available that serializes access to the kfifo buffer with a per-channel spinlock shared between the IRQ handler and file reader, preventing concurrent unsynchronized access. Users should apply the official Linux kernel patch that includes this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and patch details.