{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2"
            },
            {
              "fixed": "44ee19422aa82a6847594866de7e5a31e4ef98b3"
            },
            {
              "fixed": "7b8a574da5d7ea99b943f7a3458a17a1d95e8838"
            },
            {
              "fixed": "d50e2019c9d7c433f56d9dff65703eb904aa1fb1"
            },
            {
              "fixed": "a672682d39dd34e2b5ba4feb436723bed65125ff"
            },
            {
              "fixed": "aefc1a97da17d8309974690c8a03e439a91ebb1c"
            },
            {
              "fixed": "ee5737891464030a189837467df3b81a273718ad"
            },
            {
              "fixed": "d0fb4d1dc43f8d5179917a2daaa82680993d4cdf"
            },
            {
              "fixed": "0eb09f737428e482a32a2e31e5e223f2b35a71d3"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.12"
            },
            {
              "fixed": "5.10.258"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.209"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.175"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.140"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.86"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.27"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45994.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix OOB reads in command_file_write due to missing size checks\n\nThe command_file_write() handler allocates a kernel buffer of exactly\ncount bytes and copies user data into it, but does not validate the\nbuffer against the dot command protocol before passing it to\nget_dot_command_size() and get_dot_command_timeout().\n\nSince both the allocation size (count) and the header fields (command_size,\ndata_size) are independently user-controlled, an attacker can cause\nget_dot_command_size() to return a value exceeding the allocation,\ntriggering OOB reads in get_dot_command_timeout() and an out-of-bounds\nmemcpy_toio() that leaks kernel heap memory to the service processor.\n\nFix with two guards: reject writes smaller than sizeof(struct\ndot_command_header) before allocation, then after copying user data\nreject commands where the buffer is smaller than the total size declared\nby the header (sizeof(header) + command_size + data_size). This ensures\nall subsequent header and payload field accesses stay within the buffer.",
  "id": "CVE-2026-45994",
  "modified": "2026-07-08T05:39:13.022830378Z",
  "published": "2026-05-27T12:55:47.612Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0eb09f737428e482a32a2e31e5e223f2b35a71d3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/44ee19422aa82a6847594866de7e5a31e4ef98b3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7b8a574da5d7ea99b943f7a3458a17a1d95e8838"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a672682d39dd34e2b5ba4feb436723bed65125ff"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aefc1a97da17d8309974690c8a03e439a91ebb1c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d0fb4d1dc43f8d5179917a2daaa82680993d4cdf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d50e2019c9d7c433f56d9dff65703eb904aa1fb1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ee5737891464030a189837467df3b81a273718ad"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45994.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45994"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.7.5",
  "summary": "ibmasm: fix OOB reads in command_file_write due to missing size checks"
}