CVE-2026-74603
ptp: ocp: Fix board ID over-read
Description
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink_info_version_fixed_put() treats it as a C string and may read beyond the field. Format at most OCP_BOARD_ID_LEN bytes into the existing local buffer before reporting the ID. Use a precision limit because the snprintf() output size alone does not bound the source string scan.
INFO
Published Date :
Aug. 22, 2026, 4:16 p.m.
Last Modified :
Aug. 22, 2026, 4:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Ensure board ID fits within buffer.
- Limit length before reporting.
- Use precision limit with snprintf.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74603.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74603 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74603
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74603 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74603 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 22, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0cfcdd1ebcfe1a9b262f6ad8419580720dc843c4', 'lessThan': '72ef3ce80078199bfad32f98d055f44ba7cd0c3d', 'versionType': 'git'}, {'status': 'affected', 'version': '0cfcdd1ebcfe1a9b262f6ad8419580720dc843c4', 'lessThan': '3d965811be78473654e6e8cc8e4fb7b6b87aa6c1', 'versionType': 'git'}, {'status': 'affected', 'version': '0cfcdd1ebcfe1a9b262f6ad8419580720dc843c4', 'lessThan': 'f92558bbe78d6284fedd053900f82a70f0aa8707', 'versionType': 'git'}, {'status': 'affected', 'version': '0cfcdd1ebcfe1a9b262f6ad8419580720dc843c4', 'lessThan': '5fd91dd4a143479b0575fb1f202ec1c501e71fd5', 'versionType': 'git'}, {'status': 'affected', 'version': '0cfcdd1ebcfe1a9b262f6ad8419580720dc843c4', 'lessThan': 'f8d7e5751267637190eff887c971d5b468106213', 'versionType': 'git'}, {'status': 'affected', 'version': '0cfcdd1ebcfe1a9b262f6ad8419580720dc843c4', 'lessThan': '6b69f2ef10cdb018c0b127a7cab88e590bbddba4', 'versionType': 'git'}], 'programFiles': ['drivers/ptp/ptp_ocp.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/ptp/ptp_ocp.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink_info_version_fixed_put() treats it as a C string and may read beyond the field. Format at most OCP_BOARD_ID_LEN bytes into the existing local buffer before reporting the ID. Use a precision limit because the snprintf() output size alone does not bound the source string scan. Added Reference https://git.kernel.org/stable/c/3d965811be78473654e6e8cc8e4fb7b6b87aa6c1 Added Reference https://git.kernel.org/stable/c/5fd91dd4a143479b0575fb1f202ec1c501e71fd5 Added Reference https://git.kernel.org/stable/c/6b69f2ef10cdb018c0b127a7cab88e590bbddba4 Added Reference https://git.kernel.org/stable/c/72ef3ce80078199bfad32f98d055f44ba7cd0c3d Added Reference https://git.kernel.org/stable/c/f8d7e5751267637190eff887c971d5b468106213 Added Reference https://git.kernel.org/stable/c/f92558bbe78d6284fedd053900f82a70f0aa8707