HIGH Introduced in 6.15
cxl GetFeature OOB
CVE-2026-93079
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len, but the device is told to write cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTL_RPC. Reject requests where count exceeds the available payload room, before allocating.
02KernelScan AI Analysis
Risk summary
A local attacker with CAP_SYS_ADMIN on a system with CXL hardware can trigger a heap out-of-bounds write through the fwctl RPC interface by supplying a large device-write count paired with a small output buffer. This can corrupt kernel heap memory, potentially leading to privilege escalation beyond existing capabilities or a system crash. The vulnerability requires CXL hardware to be present and the fwctl subsystem to be accessible.
Vulnerability analysis
The CXL feature retrieval path allocates an output buffer sized from one user-supplied length value, but separately passes a different user-controlled count to the CXL device instructing it how many bytes to write into that buffer. When the count exceeds the buffer's actual payload capacity, the device writes past the end of the heap-allocated buffer, corrupting adjacent kernel memory. The fix adds a bounds check before allocation that rejects any request where the count exceeds the available payload room in the output buffer. This path is reachable locally through the fwctl RPC ioctl, which requires CAP_SYS_ADMIN in the init namespace and CXL hardware to be present on the system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.15 | 6.18.52 | 3f02031a0a53 |
| 7.2 | 6.15 | 7.2.6 | 329ea475581c |
| mainline | 6.15 | 7.3-rc1 | 4bf6bac37507 |