CVE-2026-93078 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Reject Set Features output buffer smaller than the header
cxlctl_set_feature() sizes its output buffer from the user's fwctl_rpc.out_len but never checks it is large enough to hold even the fwctl_rpc_cxl_out header. With out_len == 0 , kvzalloc() returns ZERO_SIZE_PTR, which passes the !rpc_out check, the subsequent rpc_out->size = 0 then writes through the poison pointer.
Reject requests whose output buffer can't hold the response header, before allocating. The Set Feature reply carries no payload, so the header is all that is required.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified in the cxl/features subsystem represents a critical memory safety flaw rooted in insufficient input validation during feature configuration operations. Specifically, the function cxlctl_set_feature() allocates an output buffer based on the length provided by the user through fwctl_rpc.out_len without verifying that this size is sufficient to accommodate the mandatory response header structure known as fwctl_rpc_cxl_out. This oversight creates a scenario where malicious or malformed input can trigger undefined behavior, leading to potential system instability or privilege escalation depending on the execution context and memory layout at runtime.
The technical mechanism of exploitation involves passing an output buffer length that is either zero or smaller than the size required for the response header. When out_len equals zero, the kernel's allocation function kvzalloc() returns a special pointer known as ZERO_SIZE_PTR rather than NULL. This specific return value often passes subsequent null-pointer checks such as !rpc_out because it is not strictly equal to NULL in many implementations or logic paths that do not explicitly handle this edge case. Consequently, the code proceeds to assign values to fields within the rpc_out structure, specifically setting rpc_out->size = 0. Since ZERO_SIZE_PTR points to a memory region that should not be accessed for writing, this operation results in a write-through-a-poison-pointer scenario. This constitutes an out-of-bounds write or heap corruption vulnerability, as the kernel attempts to modify data at an invalid or unmapped address range designated by the allocator for zero-size requests.
From a security classification perspective, this flaw aligns with CWE-1342: Out of Bounds Write and CWE-787: Out-of-bounds Write in C/C++. The vulnerability allows an attacker who can invoke the cxl feature control interface to corrupt kernel memory structures. Depending on what lies adjacent to the allocated region or how the ZERO_SIZE_PTR is handled by subsequent code, this could lead to a denial of service through kernel panic or potentially arbitrary code execution if the corrupted data influences critical control flow pointers. The attack vector falls under ATT&CK technique T1059: Command and Scripting Interpreter if leveraged via higher-level interfaces that expose this vulnerability, though more directly it relates to local privilege escalation vectors where an unprivileged user interacts with hardware management features exposed through sysfs or similar kernel APIs.
The operational impact of this vulnerability is significant for systems relying on CXL (Compute Express Link) technology and its associated feature control mechanisms. An attacker with access to the relevant device interfaces can trigger memory corruption, leading to system crashes that disrupt availability services. In more sophisticated scenarios, if the corrupted memory region overlaps with sensitive kernel data structures such as function pointers or security tokens, it could be exploited for privilege escalation, allowing a low-privilege user to gain root-level access. This undermines the integrity and confidentiality guarantees provided by the operating system's isolation mechanisms.
To mitigate this vulnerability, developers must implement strict size validation before any memory allocation occurs in the cxlctl_set_feature() function. The code should explicitly check that fwctl_rpc.out_len is greater than or equal to the sizeof(struct fwctl_rpc_cxl_out) header structure. If the provided length is insufficient, the request should be rejected immediately with an appropriate error code such as -EINVAL rather than proceeding to allocate memory and perform writes. This preventive measure ensures that no invalid pointers are dereferenced and prevents the write-through-poison-pointer condition from occurring. Additionally, enhancing static analysis tools to detect patterns where ZERO_SIZE_PTR might bypass null checks can help identify similar issues in other parts of the kernel codebase. Regular auditing of user-space input validation against expected data structures is essential for maintaining robust security posture in device driver implementations.