CVE-2026-93077

What it actually does

The cxl_get_feature function reads device feature data in a loop but repeatedly passes a fixed output buffer size instead of the shrinking remaining capacity; on the final partial read a device can therefore return more bytes than the leftover buffer holds, overflowing feat_out.

Why it matters to the business

Systems using CXL hardware may experience kernel memory corruption that leads to crashes, data corruption, or local code execution, requiring urgent patching of production kernels that handle CXL-attached accelerators or memory expanders.

How an attack unfolds

An attacker with the ability to present a malicious or compromised CXL device supplies more feature data than the remaining output buffer can hold on the last iteration of the read loop, triggering the overflow and potentially allowing kernel memory overwrite.

How to fix it

Update to a Linux kernel containing the fix that replaces the fixed size_out argument with the per-iteration data_to_rd_size value; rebuild and reboot all affected hosts with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains the commit that changes cxl_get_feature to pass data_to_rd_size as the output capacity; re-test feature enumeration with a device that returns partial data on the last read.

Typical attack path

1. Gain ability to attach or emulate a CXL device visible to the target kernel
2. Trigger cxl_get_feature on a feature whose total size requires multiple loop iterations
3. Return oversized data on the final iteration to exceed the shrinking buffer
4. Leverage the resulting kernel memory corruption for privilege escalation or denial of service

How to detect it

Look in kernel logs for oops or panic messages referencing cxl_get_feature or feat_out buffer handling; examine dmesg and syslog around times when CXL devices are enumerated.

What your security team should do

• Prioritize kernel updates on all hosts that expose CXL devices
• Verify that the fixed version is deployed before re-attaching production CXL hardware
• Monitor for kernel oops or memory corruption events involving cxl_get_feature until patching is complete