Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) DMA-align output buffer Sashiko reports: When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA. When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation. Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption. Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:18:00.500Z",
  "pubdate": "2026-08-15T13:18:00.500Z",
  "executiveSummary": "A memory corruption vulnerability exists in the Linux kernel hardware monitoring driver for NZXT Smart2 devices, specifically within the nzxt-smart2 module.\nThe vulnerability is classified as a DMA alignment issue resulting in cacheline sharing and concurrent memory corruption on non-coherent architectures.\nThe impact includes system instability, kernel crashes, and potential arbitrary memory modification when interacting with the affected hardware.\nAffected systems include those running the Linux kernel utilizing the nzxt-smart2 hwmon driver on non-coherent CPU architectures such as ARM or MIPS.\nThe risk implications involve potential denial of service or localized privilege escalation via kernel memory corruption if an attacker can trigger driver operations.\nAttacker capabilities require local access or the ability to execute operations that trigger send_output_report(), such as setting fan speeds or updating intervals.\nExploitation requirements include running on a non-coherent CPU architecture where CONFIG_DMA_API_DEBUG detects DMA mapping violations and flushes or invalidates cachelines sharing adjacent variables.",
  "technicalDetails": "The vulnerability resides in the send_output_report() function within the Linux kernel hwmon subsystem, specifically affecting the nzxt-smart2 driver.\nThe root cause stems from passing an output buffer to hid_hw_output_report() which subsequently invokes usb_interrupt_msg() to map the buffer directly for Direct Memory Access (DMA).\nOn non-coherent CPU architectures such as ARM or MIPS, cacheline sharing between the unaligned output buffer and adjacent critical kernel variables—specifically mutex and update_interval—causes severe memory corruption.\nWhen the DMA mapping flushes or invalidates the cacheline, it overwrites adjacent variables that were modified concurrently by the CPU, violating DMA safety guarantees.\nThe attack flow is triggered whenever an operation invokes send_output_report(), such as modifying a fan speed or updating the polling interval.\nThis operation forces a USB DMA mapping event that immediately and deterministically corrupts memory on systems utilizing non-coherent caches.\nThe DMA API debugging tool (CONFIG_DMA_API_DEBUG) explicitly catches and triggers runtime warnings for this architectural violation.\nPrerequisites for triggering the underlying defect include local execution capabilities or device interaction that initiates output reports to the NZXT Smart2 hardware on an unsupported or improperly aligned non-coherent hardware platform."
}