Executive brief
The Linux kernel's CXL (Compute Express Link) subsystem contains a heap buffer overflow vulnerability in the feature management code. An attacker with access to the FWCTL_RPC interface can trigger a heap overflow by providing mismatched buffer size and count parameters, potentially leading to code execution or denial of service on systems using CXL memory or compute expansion hardware.
Technical details
The vulnerability exists in the cxlctl_get_feature() function within drivers/cxl/core/features.c. The function allocates an output buffer based on user-supplied out_len but the device writes count bytes into the payload, with no validation that count fits within the allocated buffer. This creates a heap out-of-bounds (OOB) write condition reachable through the FWCTL_RPC ioctl interface. The fix adds validation to reject requests where count exceeds available payload room before memory allocation occurs. The vulnerability affects the CXL feature discovery mechanism and requires local access to the FWCTL_RPC interface.
Affected products
- Linux Linux kernel affects multiple versions; patch applied as commit 4bf6bac375076ced2fa4b3fef8739bd985f93456
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-09-14: patched: Fix included in stable kernel releases via commit 329ea475581c647a680a6937e353c1a6e2534b40 and 3f02031a0a53de0d3ef066c92d0486b2b11be40c