CVE-2026-93079

cxl/features: Reject Get Feature count larger than the output buffer

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

cxl/features: Reject Get Feature count larger than the output buffer

cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len, but the device is told to write cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTL_RPC.

Reject requests where count exceeds the available payload room, before allocating.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5908f3ed6dc209e5c824e63afda7545805f75a7e to before 3f02031a0a53de0d3ef066c92d0486b2b11be40cAffected 5908f3ed6dc209e5c824e63afda7545805f75a7e to before 329ea475581c647a680a6937e353c1a6e2534b40Affected 5908f3ed6dc209e5c824e63afda7545805f75a7e to before 4bf6bac375076ced2fa4b3fef8739bd985f93456Affected
LinuxLinux	6.15Affected before 6.15Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.Not affected 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.