CVE-2026-74551: hwmon: (nzxt-smart2) DMA-align output buffer

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nzxt-smart2) DMA-align output buffer

Sashiko reports:

When send_output_report() calls hid_hw_output_report(), the underlying USB
HID core calls usb_interrupt_msg() which maps this buffer directly for DMA.

When the DMA mapping flushes or invalidates the cacheline, it will corrupt
the adjacent variables (mutex, update_interval) that were modified
concurrently by the CPU. This causes memory corruption due to cacheline
sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA
API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings
for this violation.

Any operation that triggers send_output_report() (like setting a fan speed
or updating the interval) causes the USB DMA mapping. On systems with
non-coherent caches, this structural bug causes immediate and deterministic
memory corruption.

Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.

The Linux kernel CVE team has assigned CVE-2026-74551 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit 53e68c20aeb1e23419bed811aa3a309ceda200f9 and fixed in 6.6.151 with commit 70ad543ce81f368411b6c721265a3b2d7ab4fda4
	Issue introduced in 5.17 with commit 53e68c20aeb1e23419bed811aa3a309ceda200f9 and fixed in 6.12.103 with commit 51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f
	Issue introduced in 5.17 with commit 53e68c20aeb1e23419bed811aa3a309ceda200f9 and fixed in 6.18.44 with commit 2332d35aaf206c17acf848522817252732596676
	Issue introduced in 5.17 with commit 53e68c20aeb1e23419bed811aa3a309ceda200f9 and fixed in 7.1.8 with commit 6a2dbce5da2d2163a5b684acf68a0e54582ff0fa
	Issue introduced in 5.17 with commit 53e68c20aeb1e23419bed811aa3a309ceda200f9 and fixed in 7.2-rc6 with commit 080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74551
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hwmon/nzxt-smart2.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/70ad543ce81f368411b6c721265a3b2d7ab4fda4
	https://git.kernel.org/stable/c/51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f
	https://git.kernel.org/stable/c/2332d35aaf206c17acf848522817252732596676
	https://git.kernel.org/stable/c/6a2dbce5da2d2163a5b684acf68a0e54582ff0fa
	https://git.kernel.org/stable/c/080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8