CVE-2026-93077: cxl/features: Clamp Get Feature output size to the remaining buffer
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Clamp Get Feature output size to the remaining buffer
cxlgetfeature() reads a feature in a loop but passes a fixed sizeout as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow featout.
Use the per-iter size datatordsize, which already tracks the remaining room, as the output capacity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required for the overflow to occur?
The kernel must read a CXL feature over multiple loop iterations, with the final iteration having less buffer space remaining. A device must return more data than requested during that final partial iteration, allowing output to exceed the remaining space in feat_out.
What part of the kernel behavior is corrected by the fix?
The fix changes cxl_get_feature() to use the per-iteration remaining size, data_to_rd_size, as the output capacity. This prevents a device response from being written beyond the space left in the output buffer.