CVE-2026-89731: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
In the Linux kernel, the following vulnerability has been resolved:
cxl/ras: Fix cxlrchgetaerinfo() out-of-bounds AER register read
cxlrchgetaerinfo() copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aercapabilityregs). This struct is a software layout and its embedded struct pcietlplog is larger than the on-wire AER capability. As a result the loop reads past the mapped AER register block.
The over-read also populates the software-only tail fields including headerlog.headerlen. An out-of-range headerlen passed to pcieprinttlplog() can then loop past the header log buffer and cause a second out-of-bounds read.
The read was correct when introduced, but struct pcietlplog has since grown (Header Log and TLP Prefix Log sizes, headerlen and flit fields), so sizeof(struct aercapabilityregs) no longer matches the physical AER capability.
Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cxl_rch_get_aer_info(), bound the read to the physical AER registers—from the header through the 16-byte Header Log—instead of using sizeof(struct aer_capability_regs).
- Compensating control
Zero the destination structure before copying the RCH Downstream Port AER capability so software-only fields, including header_log.header_len, are deterministic.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected code path is the CXL RAS handling for an RCH Downstream Port, where AER capability data is copied from the RCRB MMIO block. Systems that do not use this path are not described as affected by the provided information.
What happens after the initial out-of-bounds register read?
The over-read can populate software-only fields, including header_log.header_len. If that value is out of range and is passed to pcie_print_tlp_log(), processing can read past the header log buffer a second time.
What does the resolved change do to prevent the issue?
It limits MMIO reads to the physical AER registers through the 16-byte Header Log rather than using the size of the software structure. It also zeroes the destination structure first so software-only fields have deterministic values.