EUVD-2026-76655
GHSA-ggmc-fhxw-v94j
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Requires compromised NSM virtio backend (AC:H); /dev/nsm access is privilege-restricted (PR:L); OOB read causes heap disclosure only (C:H, A:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
misc: nsm: bound the device-reported response length
nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parse_resp_raw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). The request path already floors its length in fill_req_raw(); the response path lacks the symmetric check.
Clamp the stored length to the size of the response buffer. Well-behaved devices report no more than the posted buffer size, so conforming traffic is unaffected.
AnalysisAI
Out-of-bounds kernel heap read in the Linux kernel's Nitro Secure Module (NSM) virtio driver allows a malicious or buggy NSM backend to disclose adjacent kernel heap memory to user space. The driver stores the used-ring response length reported by the backend device without clamping it to the actual response buffer size; parse_resp_raw() then copies that unclamped length of bytes to user space, leaking heap contents to the calling process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) a malicious or compromised NSM virtio backend capable of returning a manipulated used-ring length - in AWS Nitro deployments this means a compromised hypervisor layer or a MITM on the virtio transport channel; (2) the Linux NSM kernel driver must be loaded and an NSM character device present (/dev/nsm), which is exclusive to AWS Nitro EC2 instances with the Nitro Secure Module; (3) a user-space process with sufficient permission to open /dev/nsm must issue an NSM request, triggering the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 7.7 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) warrants re-evaluation on two metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or later; the fix clamps the stored response length to sizeof(msg->resp) in nsm_sendrecv_msg_locked(), restoring the symmetric bound-check already present in the request path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running Linux kernel versions before 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 that use NSM driver functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today