CVE-2026-74551

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nzxt-smart2) DMA-align output buffer

Sashiko reports:

When send_output_report() calls hid_hw_output_report(), the underlying USB

HID core calls usb_interrupt_msg() which maps this buffer directly for DMA.

When the DMA mapping flushes or invalidates the cacheline, it will corrupt

the adjacent variables (mutex, update_interval) that were modified

concurrently by the CPU. This causes memory corruption due to cacheline

sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA

API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings

for this violation.

Any operation that triggers send_output_report() (like setting a fan speed

or updating the interval) causes the USB DMA mapping. On systems with

non-coherent caches, this structural bug causes immediate and deterministic

memory corruption.

Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.