CVE-2026-89571: cxl/features: bound fwctl command payload to the input buffer
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: bound fwctl command payload to the input buffer
fwctlcmdrpc() copies cmd->inlen bytes into inbuf = kvzalloc(cmd->inlen) and passes inbuf and inlen to ->fwrpc(). The CXL callback cxlctlfwrpc() ignores inlen and never checks the user-controlled opsize against it.
cxlctlsetfeature() bounds opsize only from below (opsize <= sizeof(featin->hdr)) and then reads opsize - sizeof(hdr) bytes from featin->featdata via cxlsetfeature(). With a small inlen and a large opsize the first memcpy() already reads past the kvzalloc(inlen) buffer; the out-of-bounds bytes are placed in the mailbox payload and sent to the device, and a large enough opsize can walk into unmapped memory and oops the kernel. The Get paths pin opsize to a fixed size but likewise read the input struct without checking inlen.
Reject, at the single dispatch point, any request whose fixed header plus opsize does not fit in the copied-in buffer. The lower-bound test guards the subtraction and ensures opsize was copied in before it is read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
At the single fwctl dispatch point, reject any request whose fixed header plus op_size does not fit within the copied-in input buffer; ensure the lower-bound check occurs before subtracting the header size and reading the payload.
Event History
Frequently Asked Questions
Which firmware-control operations are affected?
The Set Feature path can use a user-controlled op_size that exceeds the copied input buffer. Get paths use a fixed op_size, but they also read the input structure without verifying that the supplied input buffer is large enough.
What malformed input is required to trigger the out-of-bounds access?
A request must provide a small input length while declaring a large op_size. This causes the Set Feature path to read feature data beyond the allocated input buffer and include those bytes in the device mailbox payload; a sufficiently large op_size can reach unmapped memory and oops the kernel.
How does the resolved code prevent the issue?
The dispatch point rejects requests unless the fixed header plus op_size fits within the copied-in input buffer. The existing lower-bound check remains necessary to ensure op_size is large enough before subtracting the header size.