UBUNTU-CVE-2026-89571: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc() copies cmd->inlen bytes into inbuf = kvzalloc(cmd->inlen) and passes inbuf and inlen to ->fwrpc(). The CXL callback cxlctlfwrpc() ignores inlen and never checks the user-controlled opsize against it. cxlctlsetfeature() bounds opsize only from below (opsize <= sizeof(featin->hdr)) and then reads opsize - sizeof(hdr) bytes from featin->featdata via cxlsetfeature(). With a small inlen and a large opsize the first memcpy() already reads past the kvzalloc(inlen) buffer; the out-of-bounds bytes are placed in the mailbox payload and sent to the device, and a large enough opsize can walk into unmapped memory and oops the kernel. The Get paths pin opsize to a fixed size but likewise read the input struct without checking inlen. Reject, at the single dispatch point, any request whose fixed header plus opsize does not fit in the copied-in buffer. The lower-bound test guards the subtraction and ensures opsize was copied in before it is read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
At the fwctl single dispatch point, reject requests unless the fixed header is present and the header plus user-controlled op_size fits within in_len (equivalently, after a lower-bound check, require op_size <= in_len - sizeof(header)); apply the same input-length validation to CXL Get paths and cxlctl_set_feature() before reading feat_data.