CVE-2026-93079 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Reject Get Feature count larger than the output buffer
cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len, but the device is told to write cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTL_RPC.
Reject requests where count exceeds the available payload room, before allocating.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel vulnerability identified in the cxl/features subsystem represents a critical memory safety flaw rooted in improper input validation and boundary checking within the mailbox command handling logic. Specifically, the function cxlctl_get_feature is responsible for processing feature retrieval requests from user space via the fwctl_rpc interface. The core technical deficiency lies in how output buffer sizes are determined versus how many bytes the hardware device is instructed to write into that buffer. The code allocates an output buffer based on a value provided by the user, referred to as out_len, which dictates the size of memory allocated using kvzalloc. However, when preparing the mailbox command structure sent to the CXL device, the kernel uses a separate field called count from the input payload to specify how many bytes the hardware should write back into the rpc_out->payload buffer. Crucially, there is no validation step that ensures the requested byte count does not exceed the allocated out_len size. This disconnect between allocation size and expected write volume creates a direct path for heap-based buffer overflow attacks.
This vulnerability allows an attacker with access to the FWCTL_RPC interface to trigger a heap out-of-bounds (OOB) write by submitting a request where the feature data count is significantly larger than the specified output length. Because the kernel trusts the user-supplied out_len for memory allocation but relies on the potentially maliciously crafted count field for the hardware operation, it allocates insufficient memory space. When the CXL device executes the command and writes back more data than allocated, it overwrites adjacent heap memory structures. This type of flaw is classified under CWE-120: Buffer Copy without Checking Size of Input, as the software copies input into a buffer without verifying that the input fits within the bounds of the buffer. Furthermore, because this interaction occurs through a user-facing interface like FWCTL_RPC, it falls under CWE-787: Out-of-bounds Write on an Unrestricted Search Space, highlighting the severity of writing to arbitrary memory locations due to unchecked boundaries.
The operational impact of such a heap overflow is severe and multifaceted. An attacker can leverage this vulnerability to corrupt kernel heap metadata, leading to potential denial of service through system crashes or instability as the kernel attempts to manage corrupted memory structures. More critically, skilled attackers may exploit these out-of-bounds writes to achieve arbitrary code execution within the kernel space. By carefully crafting the overflow payload, an adversary could overwrite function pointers, return addresses, or other control flow data on the heap, thereby gaining full privileges over the host system. This effectively bypasses standard user-space isolation mechanisms and compromises the integrity of the entire operating environment. The vulnerability is particularly dangerous because it does not require physical access to the hardware but rather just API-level access through the firmware control interface, which may be exposed in virtualized or containerized environments where such interfaces are passed through to guest systems.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques associated with Privilege Escalation and Defense Evasion on Linux-based systems. Specifically, it relates to the exploitation of memory corruption vulnerabilities to gain higher-level access than originally permitted by system policies. The attack vector is classified as Local because it requires interaction with a local interface, but if that interface is accessible via network-facing services or virtualization layers, the scope expands significantly. Mitigation strategies must focus on strict input validation and defensive programming practices within kernel drivers. Developers should implement explicit checks to ensure that any size parameter derived from user space does not exceed predefined limits or allocated buffer sizes before proceeding with hardware commands. In this specific case, the fix involves rejecting requests where the feature count exceeds the available payload room prior to memory allocation. System administrators can mitigate risk by ensuring all kernel updates are applied promptly and by restricting access to fwctl_rpc interfaces to only trusted processes through appropriate Linux Security Modules or capabilities configurations until patches are deployed.