Cloudanix VulnDB

CVE-2026-93078

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain hardware-control requests can let a logged-in user crash the whole system or potentially gain higher privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing length validation on user-supplied output buffer size in cxlctl_set_feature allows a zero-length allocation that returns a poison pointer; subsequent header write dereferences the invalid pointer.

Why it matters to the business

Local users can trigger a kernel crash or memory corruption on systems exposing the CXL feature interface, leading to denial of service or potential privilege escalation with no observed in-the-wild exploitation.

How an attack unfolds

An attacker invokes the set-feature path with an output length of zero; the kernel allocates a ZERO_SIZE_PTR, skips the null check, then writes the response header through the poison pointer, crashing the kernel or corrupting adjacent memory.

How to fix it

Apply the upstream kernel patch that rejects set-feature requests whose output buffer cannot contain the response header before performing allocation; rebuild and reboot with a fixed kernel version.

How to confirm the fix worked

Confirm the patch is present by inspecting the cxl/features.c source for the added buffer-size check before kvzalloc; test with a zero-length output request that now returns an error instead of dereferencing the poison pointer.

Typical attack path

  1. Obtain local access on a Linux system with CXL support enabled
  2. Locate or load a userspace utility that calls the fwctl/CXL set-feature ioctl
  3. Supply an out_len value of zero in the request structure
  4. Trigger the allocation and header write through the invalid pointer

How to detect it

Review kernel logs for oops or panic messages referencing cxl/features or ZERO_SIZE_PTR writes; examine audit logs for unusual ioctl calls to CXL feature paths from untrusted processes.

What your security team should do

  • Prioritize kernel updates on any host exposing CXL or fwctl interfaces
  • Restrict unprivileged access to CXL device nodes via permissions or LSM policy
  • Monitor for local privilege-escalation attempts targeting kernel feature ioctls
  • Track EPSS and KEV updates given the current low exploitation probability

The record

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctl_set_feature() sizes its output buffer from the user's fwctl_rpc.out_len but never checks it is large enough to hold even the fwctl_rpc_cxl_out header. With out_len == 0 , kvzalloc() returns ZERO_SIZE_PTR, which passes the !rpc_out check, the subsequent rpc_out->size = 0 then writes through the poison pointer. Reject requests whose output buffer can't hold the response header, before allocating. The Set Feature reply carries no payload, so the header is all that is required.

Affected packages

Ecosystem Package Introduced Fixed