{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read  put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing with snoop_file_read(), which also consumes via kfifo_to_user(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp to (in - out) is ineffective and kfifo_copy_to_user() can attempt a copy_to_user() past the kmalloc-2k backing store:    usercopy: Kernel memory exposure attempt detected from SLUB object   'kmalloc-2k' (offset 0, size 2049)!   kernel BUG at mm/usercopy.c!   Call trace:    usercopy_abort    __check_heap_object    __check_object_size    kfifo_copy_to_user    __kfifo_to_user    snoop_file_read    vfs_read  Serialize kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer).  Annotate @fifo with __guarded_by(\u0026lock) and opt the driver into context analysis so the compiler enforces that all fifo access holds the lock.",
  "id": "DEBIAN-CVE-2026-74729",
  "modified": "2026-09-14T16:47:41.397921052Z",
  "published": "2026-08-22T16:16:48.033Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74729"
    }
  ],
  "upstream": [
    "CVE-2026-74729"
  ]
}