Cloudanix VulnDB

CVE-2026-23327

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain hardware commands could let a logged-in user crash the system or peek at internal memory.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds kernel memory read (slab-out-of-bounds) when cxl_payload_from_user_allowed casts and dereferences an undersized user-supplied mailbox payload without size validation, allowing uuid_equal to access data past the allocated buffer.

Why it matters to the business

Local users on CXL-enabled Linux systems can trigger kernel crashes or limited memory disclosure, causing denial of service and potential exposure of sensitive kernel data on servers and appliances using Compute Express Link hardware.

How an attack unfolds

A local attacker invokes the CXL memory device ioctl with a raw mailbox command (such as CXL_MBOX_OP_CLEAR_LOG) that supplies a payload smaller than expected, bypassing size checks so that uuid_equal reads beyond the buffer and produces a KASAN splat.

How to fix it

Apply the upstream patch that adds the 'in_size' parameter to cxl_payload_from_user_allowed and performs the size check before dereferencing; rebuild and deploy the fixed kernel on all affected hosts.

How to confirm the fix worked

Confirm the presence of the size-validation change in drivers/cxl/core/mbox.c, then re-run the original reproducer under KASAN to ensure the slab-out-of-bounds report no longer occurs.

Typical attack path

  1. Obtain local unprivileged shell on target Linux system with CXL support
  2. Prepare a raw CXL mailbox command structure containing an undersized payload
  3. Invoke cxl_memdev_ioctl via /dev/cxl/memX to reach cxl_send_cmd
  4. Trigger the missing size validation path in cxl_payload_from_user_allowed

How to detect it

Search kernel logs (dmesg, journalctl) for KASAN slab-out-of-bounds reports citing memcmp, uuid_equal, cxl_payload_from_user_allowed, or cxl_mbox_cmd_ctor; correlate with ioctl activity on CXL device nodes.

  • BUG: KASAN: slab-out-of-bounds in memcmp
  • cxl_payload_from_user_allowed drivers/cxl/core/mbox.c
  • cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c

What your security team should do

  • Patch all Linux kernels to a version containing the mailbox payload size fix as soon as packages are available
  • Restrict untrusted local accounts from accessing /dev/cxl/mem* devices via device ACLs or SELinux policy
  • Enable KASAN or similar memory-safety instrumentation on test systems to surface similar issues early

The record

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() cxl_payload_from_user_allowed() casts and dereferences the input payload without first verifying its size. When a raw mailbox command is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG, which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer, triggering a KASAN splat: BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683 Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258 CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xce/0x650 mm/kasan/report.c:482 kasan_report+0xce/0x100 mm/kasan/report.c:595 memcmp+0x176/0x1d0 lib/string.c:683 uuid_equal include/linux/uuid.h:73 [inline] cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline] cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline] cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline] cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643 __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline] cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdaf331ba79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79 RDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003 RBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768 </TASK> Add 'in_size' parameter to cxl_payload_from_user_allowed() and validate the payload is large enough.

Affected packages

Ecosystem Package Introduced Fixed
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.35.1.160000.2.16
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.35.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.35.1

Related vulnerabilities