CVE-2026-93079: cxl/features: Reject Get Feature count larger than the output buffer
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Reject Get Feature count larger than the output buffer
cxlctlgetfeature() sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout->payload, which is a separate user-controlled value. Nothing bounds count against outlen, so a small outlen with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTLRPC.
Reject requests where count exceeds the available payload room, before allocating.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Reject Get Feature requests when cxl_mbox_get_feat_in.count exceeds the available output payload room specified by fwctl_rpc.out_len, before allocating the output buffer.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running a Linux kernel with the affected CXL feature-handling code are exposed when the FWCTL_RPC interface can be used to issue Get Feature requests. Exploitation requires control over the request output length and feature count values.
What must an attacker do to trigger the overflow?
The attacker must submit a Get Feature request with a small fwctl_rpc.out_len and a larger cxl_mbox_get_feat_in.count. The count causes the device to write more data into the output payload than the allocated buffer can hold.
How can I tell whether a system is protected?
The fix rejects Get Feature requests when the requested count exceeds the available output payload space before allocation. Check whether the running kernel includes one of the referenced stable commits or equivalent logic.
What mitigation is available if the kernel cannot be updated immediately?
Restrict access to the FWCTL_RPC interface so untrusted users cannot submit Get Feature requests. This reduces exposure because the overflow is reachable through FWCTL_RPC.