CVE-2026-93078: cxl/features: Reject Set Features output buffer smaller than the header
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Reject Set Features output buffer smaller than the header
cxlctlsetfeature() sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With outlen == 0 , kvzalloc() returns ZEROSIZEPTR, which passes the !rpcout check, the subsequent rpcout->size = 0 then writes through the poison pointer.
Reject requests whose output buffer can't hold the response header, before allocating. The Set Feature reply carries no payload, so the header is all that is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cxlctl_set_feature(), reject Set Feature requests whose fwctl_rpc.out_len is smaller than the fwctl_rpc_cxl_out response header before allocating the output buffer; the reply carries no payload.
Event History
Frequently Asked Questions
What input is required to trigger the flaw?
A caller must submit a Set Features request with an fwctl_rpc.out_len smaller than the fwctl_rpc_cxl_out response header. An out_len value of 0 causes allocation to return ZERO_SIZE_PTR and is specifically described as leading to a write through that pointer.
Does the Set Feature response require an output payload buffer beyond its header?
No. The Set Feature reply carries no payload, so an output buffer large enough for the response header is sufficient.
What does the fix change?
The fix rejects Set Features requests whose requested output buffer cannot hold the response header before attempting allocation.