CVE-2026-74551

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable send_output_report() path is reached by writing hwmon sysfs attributes (pwm*, update_interval) under /sys/class/hwmon/, a local interface. The USB stack only performs internal DMA mapping; the attacker does not need network, adjacent-network, or direct USB bus manipulation to trigger the bug.

AC:LAttack complexity, low

On non-coherent ARM/MIPS systems, each sysfs write that triggers send_output_report() deterministically causes DMA cache-line operations that corrupt the adjacent mutex and update_interval; the attacker controls when writes occur and can repeat them at will with no race or grooming required.

PR:LPrivileges required, low

The driver exposes pwm* and update_interval hwmon attributes with mode 0644 and performs no capability or credential checks on the write path; any unprivileged local user account can trigger send_output_report() without real root or init-namespace capabilities.

UI:NUser interaction, none

Exploitation requires only the attacker writing to hwmon sysfs on a system where the NZXT device is already present and bound; no victim action such as opening a file, clicking a prompt, or mounting a filesystem is needed beyond normal device presence at boot.

S:UScope, unchanged

Corruption is confined to kernel driver private data (mutex, update_interval) within the host kernel heap; impact is standard kernel memory corruption and potential privilege escalation, not crossing VM, container, or IOMMU security boundaries.

C:HConfidentiality impact, high

DMA cache-line invalidation corrupts adjacent kernel structures including struct mutex while concurrently modified by the CPU; this class of heap-adjacent memory corruption is a general primitive that can be leveraged for arbitrary kernel memory disclosure.

I:HIntegrity impact, high

Corrupting an actively held struct mutex in kernel driver private data enables control of synchronization state and adjacent heap contents, providing an exploitable kernel memory corruption primitive suitable for arbitrary write and control-flow hijacking.

A:HAvailability impact, high

Corrupted mutex and driver state cause immediate kernel instability including possible deadlock, oops, or panic on every triggering sysfs write on affected non-coherent architectures; the fix commit describes immediate and deterministic memory corruption.