Linux Kernel EUVD-2026-59616

Exploitation requires all three of the following simultaneously: (1) A non-coherent DMA CPU architecture - specifically ARM or MIPS; x86 and x86_64 systems are wholly unaffected because their DMA is cache-coherent and no explicit cache maintenance is performed; (2) NZXT Smart Device 2 USB hardware physically connected to the system and the nzxt-smart2 kernel module loaded (either manually or via udev autoloading); (3) Local access with at least low-privilege permissions sufficient to write to the hwmon sysfs interface. Triggering conditions are broad - any operation that invokes send_output_report(), including setting fan speed or modifying the monitoring interval through sysfs, causes the DMA mapping and resultant corruption. Key limiting factors constraining real-world risk: platform exclusivity (ARM/MIPS only), hardware dependency (specific consumer USB cooling controller must be present), and strictly local attack vector with no remote exploitation path.

The provided CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local exploitation with High impact triad, but overstates practical risk by ignoring significant real-world constraints. First, the bug only manifests on non-coherent DMA architectures - ARM and MIPS - because x86/x86_64 systems maintain DMA coherency without explicit cache maintenance, making the vast majority of NZXT Smart Device 2 deployments (desktop gaming PCs running x86_64) entirely unaffected. Second, the affected hardware is consumer-grade and niche: NZXT Smart Device 2 is unlikely to appear in enterprise, cloud, or server environments. Third, EPSS of 0.17% (6th percentile) confirms very low exploitation probability, consistent with the niche hardware/architecture requirement. Fourth, no KEV listing confirms no confirmed active exploitation. The CVSS AC:L metric may overstate attacker ease - in practice, successful exploitation requires a specific hardware device AND a non-coherent architecture to be present simultaneously. Real priority is limited to: ARM or MIPS Linux systems with NZXT Smart Device 2 physically attached and nzxt-smart2 module loaded. For all other configurations, risk is negligible.

A local user with low-privilege access on an ARM Linux system with NZXT Smart Device 2 USB hardware attached writes a fan speed value to the hwmon sysfs interface (e.g., /sys/class/hwmon/hwmonX/pwm1), causing the kernel to invoke send_output_report(). The USB HID core maps the misaligned kernel buffer for DMA via usb_interrupt_msg(); the subsequent DMA cache line flush overwrites the adjacent mutex and update_interval variables in kernel memory, resulting in deterministic memory corruption that can be leveraged for privilege escalation or a kernel panic. No public exploit code has been identified at time of analysis.