CVE-2026-89571: cxl/features: bound fwctl command payload to the input buffer
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: bound fwctl command payload to the input buffer
fwctlcmdrpc() copies cmd->inlen bytes into inbuf = kvzalloc(cmd->inlen) and passes inbuf and inlen to ->fwrpc(). The CXL callback cxlctlfwrpc() ignores inlen and never checks the user-controlled opsize against it.
cxlctlsetfeature() bounds opsize only from below (opsize <= sizeof(featin->hdr)) and then reads opsize - sizeof(hdr) bytes from featin->featdata via cxlsetfeature(). With a small inlen and a large opsize the first memcpy() already reads past the kvzalloc(inlen) buffer; the out-of-bounds bytes are placed in the mailbox payload and sent to the device, and a large enough opsize can walk into unmapped memory and oops the kernel. The Get paths pin opsize to a fixed size but likewise read the input struct without checking inlen.
Reject, at the single dispatch point, any request whose fixed header plus opsize does not fit in the copied-in buffer. The lower-bound test guards the subtraction and ensures opsize was copied in before it is read.
Affected Software
Event History
Frequently Asked Questions
Which firmware-control operations are affected?
The Set Feature path can use a user-controlled op_size that exceeds the copied input buffer. Get paths use a fixed op_size, but they also read the input structure without verifying that the supplied input buffer is large enough.
What malformed input is required to trigger the out-of-bounds access?
A request must provide a small input length while declaring a large op_size. This causes the Set Feature path to read feature data beyond the allocated input buffer and include those bytes in the device mailbox payload; a sufficiently large op_size can reach unmapped memory and oops the kernel.
How does the resolved code prevent the issue?
The dispatch point rejects requests unless the fixed header plus op_size fits within the copied-in input buffer. The existing lower-bound check remains necessary to ensure op_size is large enough before subtracting the header size.