Executive brief
The Linux kernel's CXL (Compute Express Link) memory subsystem contains a flaw in the Set Features command handler that fails to validate the output buffer size before writing to it. An attacker with local access could provide a zero or undersized buffer, causing the kernel to write data to a poison pointer, potentially crashing the system or enabling privilege escalation attacks.
Technical details
The vulnerability is a buffer overflow in the cxlctl_set_feature() function within drivers/cxl/core/features.c. The function allocates an output buffer using kvzalloc() based on a user-supplied size (fwctl_rpc.out_len) without validating that the buffer is large enough to hold the fwctl_rpc_cxl_out response header. When out_len is zero, kvzalloc() returns ZERO_SIZE_PTR, which passes the null pointer check; the subsequent write to rpc_out->size then dereferences this poison pointer. The fix adds an explicit check rejecting requests where the output buffer cannot hold the response header before memory allocation occurs. This is a local kernel subsystem vulnerability requiring interaction with the CXL feature control interface.
Affected products
- Linux Linux kernel affected versions prior to and including the upstream commit cde18d6c1d913a67ab0afd3d9475ece4be79da50
Timeline
- 2026-09-17: disclosed: CVE-2026-93078 published
- 2026-09-14: patched: Upstream commit cde18d6c1d913a67ab0afd3d9475ece4be79da50 merged; backported to stable kernels