Executive brief
A vulnerability was identified in the Linux kernel's firmware control (fwctl) subsystem for PDS devices. The system failed to verify the size of data sent during certain internal communications (RPC) before processing it. This could allow a local attacker to cause the system to read memory outside of the intended area, potentially leading to system instability or information disclosure.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's fwctl PDS driver (drivers/fwctl/pds/main.c). The function pdsfc_fw_rpc() casts an input buffer to 'struct fwctl_rpc_pds' and passes it to pdsfc_validate_rpc() without first verifying that the buffer is large enough to hold the structure. If a user provides a short 'in_len', the driver reads fields from the structure that reside beyond the allocated memory. This issue has been resolved by adding a size check before any parsing occurs. The fix is available in kernel versions 6.18.34, 7.0.11, and 7.1.
Affected products
- Linux Linux Kernel v6.15 to v6.18.33, v7.0.10
Timeline
- 2026-05-17: disclosed: Initial patch submitted by Heechan Kang
- 2026-07-19: advisory: CVE-2026-64101 published
- 2026-06-01: patched: Patch committed to stable trees by Greg Kroah-Hartman