CVE-2026-93077: cxl/features: Clamp Get Feature output size to the remaining buffer
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Clamp Get Feature output size to the remaining buffer
cxlgetfeature() reads a feature in a loop but passes a fixed sizeout as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow featout.
Use the per-iter size datatordsize, which already tracks the remaining room, as the output capacity.
Event History
Frequently Asked Questions
What conditions are required for the overflow to occur?
The kernel must read a CXL feature over multiple loop iterations, with the final iteration having less buffer space remaining. A device must return more data than requested during that final partial iteration, allowing output to exceed the remaining space in feat_out.
What part of the kernel behavior is corrected by the fix?
The fix changes cxl_get_feature() to use the per-iteration remaining size, data_to_rd_size, as the output capacity. This prevents a device response from being written beyond the space left in the output buffer.