CVE-2026-64101: fwctl: pds: Validate RPC input size before parsing
In the Linux kernel, the following vulnerability has been resolved:
fwctl: pds: Validate RPC input size before parsing
The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback.
pdsfcfwrpc() casts the buffer to struct fwctlrpcpds and then calls pdsfcvalidaterpc(), which reads fields from that structure before checking that the input buffer is large enough to contain it. A short inlen can make pdsfwctl read beyond the allocation.
Reject pds RPC buffers that are smaller than struct fwctlrpcpds before parsing any pds-specific fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until patched, restrict exposure of fwctl/pds RPC interfaces so untrusted clients cannot send malformed fwctl_rpc.in_len values that would cause out-of-bounds reads during pds RPC buffer parsing.