CVE-2026-89731
High · 7.1CVSS
7.1
EPSS
0.2%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's handling of certain hardware error reports could let local users read sensitive kernel information or crash the system.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds read when copying AER capability registers from MMIO, exceeding the mapped block size due to struct size mismatch with hardware layout, leading to kernel memory over-read and potential secondary out-of-bounds access in TLP log printing.
Why it matters to the business
Local users on affected Linux systems can trigger kernel crashes or read kernel memory, risking system instability and information leaks in environments using CXL hardware.
How an attack unfolds
An attacker with local access triggers the cxl_rch_get_aer_info function, which performs oversized reads from the RCRB MMIO, populating invalid header_len and causing pcie_print_tlp_log to over-read buffers.
How to fix it
Update the Linux kernel to a version containing the fix that bounds the read to physical AER registers and zeros the destination buffer.
How to confirm the fix worked
Verify kernel source for the bounded readl loop and zeroing of aer_capability_regs structure; check for patches addressing cxl_rch_get_aer_info.
Typical attack path
- Obtain local user access on target system
- Trigger CXL RAS error reporting path
- Cause out-of-bounds read in AER register handling
- Potentially leak kernel data or crash the system
How to detect it
Inspect kernel logs for oops/panics involving cxl_rch_get_aer_info or pcie_print_tlp_log; review dmesg for AER MMIO access anomalies.
What your security team should do
- Apply kernel updates promptly on all systems
- Monitor system logs for CXL/AER related crashes
- Limit untrusted local access to systems with CXL hardware
The record
In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aer_capability_regs). This struct is a software layout and its embedded struct pcie_tlp_log is larger than the on-wire AER capability. As a result the loop reads past the mapped AER register block. The over-read also populates the software-only tail fields including header_log.header_len. An out-of-range header_len passed to pcie_print_tlp_log() can then loop past the header log buffer and cause a second out-of-bounds read. The read was correct when introduced, but struct pcie_tlp_log has since grown (Header Log and TLP Prefix Log sizes, header_len and flit fields), so sizeof(struct aer_capability_regs) no longer matches the physical AER capability. Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|