Executive brief
The Linux kernel's CXL (Compute Express Link) subsystem contains a buffer overflow vulnerability in the feature-reading code. A malicious or faulty CXL device can cause kernel memory corruption by returning more data than the remaining buffer space, leading to potential system crashes or privilege escalation.
Technical details
The vulnerability is a classic buffer overflow in the cxl_get_feature() function within drivers/cxl/core/features.c. The function reads features from a CXL device in a loop, but incorrectly uses a fixed output buffer size for every iteration instead of accounting for the remaining space. On the final partial iteration, when less buffer room is available, a device returning more data than requested can overflow the feat_out buffer. The fix clamps the size_out parameter to the actual remaining space (data_to_rd_size) rather than using a pre-calculated fixed size. No authentication or special privileges are required; any user with access to a CXL device can trigger this.
Affected products
- Linux Linux kernel Affected in versions including 5.x through 7.x; patched in commit 2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83
Timeline
- 2026-06-26: other: Patch authored by Richard Cheng
- 2026-07-14: patched: Patch merged by Dave Jiang into mainline kernel
- 2026-09-17: disclosed: Assigned CVE-2026-93077 and published