Executive brief
A vulnerability in the Linux kernel's Compute Express Link (CXL) driver could allow a local user to crash the system or potentially access sensitive information. The issue occurs when the system processes hardware management commands with improperly sized data packets. This could lead to system instability or a denial-of-service condition in environments utilizing CXL-connected memory devices.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's CXL mailbox implementation (drivers/cxl/core/mbox.c). The function cxl_payload_from_user_allowed() casts and dereferences input payloads from userspace without verifying that the payload size matches the expected structure for specific opcodes (e.g., CXL_MBOX_OP_CLEAR_LOG). When an undersized payload is provided, functions like uuid_equal() perform memory comparisons beyond the allocated buffer, triggering a KASAN splat. This is reachable via ioctl calls to CXL memory devices. The vulnerability has been patched by adding explicit size validation before payload processing.
Affected products
- Linux Linux Kernel from 5.19.1 up to 6.19.7; 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-25: advisory: Initial disclosure and NVD publication
- 2026-02-24: patched: Fix committed to stable tree