UBUNTU-CVE-2026-93078: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature() sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With outlen == 0 , kvzalloc() returns ZEROSIZEPTR, which passes the !rpcout check, the subsequent rpcout->size = 0 then writes through the poison pointer. Reject requests whose output buffer can't hold the response header, before allocating. The Set Feature reply carries no payload, so the header is all that is required.