What is the CVSS score of CVE-2026-74551?

CVE-2026-74551 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74551?

The nzxt-smart2 device driver in the Linux kernel contains a memory corruption vulnerability affecting ARM and MIPS systems with NZXT Smart Device 2 hardware installed.. A patch is available.

How to fix or mitigate CVE-2026-74551?

Within 24 hours, audit your systems inventory to identify any ARM or MIPS Linux servers running with NZXT Smart Device 2 hardware attached and cross-reference their kernel versions against the vendor advisory to determine exposure. Within 7 days, apply the available patch to all identified affected systems through your standard change management process, scheduling maintenance windows as kernel updates typically require system reboot. Within 30 days, validate patch deployment across all affected systems and conduct post-patching regression testing to confirm normal operation.

Linux Kernel CVE-2026-74551

EUVD-2026-59616 HIGH

2026-08-15 Linux

GHSA-3m5x-223v-jq2m

Buffer Overflow Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects the simultaneous requirement of non-coherent architecture (ARM/MIPS) plus specific consumer hardware; PR:L for hwmon sysfs write access; all other metrics match exploitable local kernel memory corruption.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:22 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nzxt-smart2) DMA-align output buffer

Sashiko reports:

When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA.

When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation.

Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption.

Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.

AnalysisAI

Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain local low-privilege shell on ARM/MIPS Linux host

Delivery

Confirm NZXT Smart Device 2 attached and nzxt-smart2 module loaded

Exploit

Write fan speed or interval via hwmon sysfs

Execution

Trigger send_output_report() and USB DMA mapping

Persist

DMA cache flush corrupts adjacent kernel mutex/variables

Impact

Leverage memory corruption for privilege escalation or DoS

Access

Gain local low-privilege shell on ARM/MIPS Linux host

Delivery

Confirm NZXT Smart Device 2 attached and nzxt-smart2 module loaded

Exploit

Write fan speed or interval via hwmon sysfs

Execution

Trigger send_output_report() and USB DMA mapping

Persist

DMA cache flush corrupts adjacent kernel mutex/variables

Impact

Leverage memory corruption for privilege escalation or DoS

Vulnerability AssessmentAI

Exploitation	Exploitation requires all three of the following simultaneously: (1) A non-coherent DMA CPU architecture - specifically ARM or MIPS; x86 and x86_64 systems are wholly unaffected because their DMA is cache-coherent and no explicit cache maintenance is performed; (2) NZXT Smart Device 2 USB hardware physically connected to the system and the nzxt-smart2 kernel module loaded (either manually or via udev autoloading); (3) Local access with at least low-privilege permissions sufficient to write to the hwmon sysfs interface. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local exploitation with High impact triad, but overstates practical risk by ignoring significant real-world constraints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with low-privilege access on an ARM Linux system with NZXT Smart Device 2 USB hardware attached writes a fan speed value to the hwmon sysfs interface (e.g., /sys/class/hwmon/hwmonX/pwm1), causing the kernel to invoke send_output_report(). The USB HID core maps the misaligned kernel buffer for DMA via usb_interrupt_msg(); the subsequent DMA cache line flush overwrites the adjacent mutex and update_interval variables in kernel memory, resulting in deterministic memory corruption that can be leveraged for privilege escalation or a kernel panic. …
Remediation	Upgrade to a patched Linux kernel version: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit your systems inventory to identify any ARM or MIPS Linux servers running with NZXT Smart Device 2 hardware attached and cross-reference their kernel versions against the vendor advisory to determine exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-74551 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74551

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code