UBUNTU-CVE-2026-89731: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxlrchgetaerinfo() out-of-bounds AER register read cxlrchgetaerinfo() copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aercapabilityregs). This struct is a software layout and its embedded struct pcietlplog is larger than the on-wire AER capability. As a result the loop reads past the mapped AER register block. The over-read also populates the software-only tail fields including headerlog.headerlen. An out-of-range headerlen passed to pcieprinttlplog() can then loop past the header log buffer and cause a second out-of-bounds read. The read was correct when introduced, but struct pcietlplog has since grown (Header Log and TLP Prefix Log sizes, headerlen and flit fields), so sizeof(struct aercapabilityregs) no longer matches the physical AER capability. Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cxl_rch_get_aer_info(), bound the read to the physical AER registers, from the capability header through the 16-byte Header Log, rather than sizeof(struct aer_capability_regs).
- Compensating control
Zero the destination structure before copying the RCH Downstream Port AER capability so software-only fields, including header_log.header_len, are deterministic.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected Ubuntu kernel packages listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop. The vulnerable code handles RCH Downstream Port AER information from an RCRB MMIO block.
What level of access does an attacker need?
The supplied CVSS vector indicates local attack access, low attack complexity, low privileges required, and no user interaction. It also indicates high confidentiality and availability impact, with no integrity impact.
What behavior does the fix change?
The fix limits AER register reads to the physical capability registers through the 16-byte Header Log, rather than using the size of a software structure. It also zeroes the destination structure so software-only fields, including header_len, have deterministic values.