CVE-2026-93079: cxl/features: Reject Get Feature count larger than the output buffer
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Reject Get Feature count larger than the output buffer
cxlctlgetfeature() sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout->payload, which is a separate user-controlled value. Nothing bounds count against outlen, so a small outlen with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTLRPC.
Reject requests where count exceeds the available payload room, before allocating.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the affected code path so it validates that the user-controlled Get Feature 'count' does not exceed the available output buffer size derived from fwctl_rpc.out_len. If count is larger than the payload room (out_len), reject the request before performing the copy/allocations (kvzalloc) that would overflow.
Linux kernel (FWCTL_RPC / cxlctl_get_feature / cxl_mbox_get_feat_in) count bounds check vs out_len (rpc_out->payload size) = Reject requests where count exceeds available payload room before copying into the kvzalloc()/rpc_out->payload buffer
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running a Linux kernel with the affected CXL feature-handling code are exposed when the FWCTL_RPC interface can be used to issue Get Feature requests. Exploitation requires control over the request output length and feature count values.
What must an attacker do to trigger the overflow?
The attacker must submit a Get Feature request with a small fwctl_rpc.out_len and a larger cxl_mbox_get_feat_in.count. The count causes the device to write more data into the output payload than the allocated buffer can hold.
How can I tell whether a system is protected?
The fix rejects Get Feature requests when the requested count exceeds the available output payload space before allocation. Check whether the running kernel includes one of the referenced stable commits or equivalent logic.
What mitigation is available if the kernel cannot be updated immediately?
Restrict access to the FWCTL_RPC interface so untrusted users cannot submit Get Feature requests. This reduces exposure because the overflow is reachable through FWCTL_RPC.