Cloudanix VulnDB

CVE-2026-93079

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel allows a logged-in user to send a specially crafted command that writes data outside its intended memory area, which could crash the system or let the user gain higher privileges.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap out-of-bounds write in the Linux kernel CXL feature handling code where cxlctl_get_feature() allocates an output buffer sized from user-controlled fwctl_rpc.out_len but then directs the device to write cxl_mbox_get_feat_in.count bytes into that buffer without validating count against out_len, allowing overflow from a FWCTL_RPC call.

Why it matters to the business

Local attackers on affected Linux systems can corrupt kernel memory, leading to crashes, data corruption, or potential elevation of privileges that disrupt operations or allow unauthorized access to sensitive workloads.

How an attack unfolds

An attacker with local user access crafts a FWCTL_RPC request that supplies a small output buffer length but a large feature count value, triggering the kernel to perform an unbounded write into the allocated buffer and potentially executing arbitrary code or destabilizing the system.

How to fix it

Apply the upstream kernel patch that adds an explicit bounds check rejecting requests where count exceeds the available payload room before allocation; rebuild and deploy updated kernel packages across all affected systems.

How to confirm the fix worked

Confirm the presence of the bounds-check patch in the running kernel source or binary; test by attempting a Get Feature RPC with count larger than out_len and verify the request is now rejected rather than causing an overflow.

Typical attack path

  1. Obtain local shell or process execution on a Linux host with CXL support enabled
  2. Open or interact with the FWCTL device interface
  3. Issue a Get Feature RPC with mismatched out_len and count parameters
  4. Trigger the kernel path that performs the unbounded write into the kvzalloc buffer
  5. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Search kernel logs for CXL or FWCTL related oops, warnings about invalid feature counts, or memory corruption traces; audit process activity that opens CXL device nodes and issues RPC commands.

What your security team should do

  • Prioritize kernel updates on all CXL-enabled Linux systems within the next patching cycle
  • Review workloads that expose FWCTL or CXL device interfaces to untrusted local users
  • Monitor for kernel oops or memory corruption events on hosts running vulnerable kernels
  • Harden local access controls to limit exposure to the FWCTL_RPC interface

The record

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len, but the device is told to write cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTL_RPC. Reject requests where count exceeds the available payload room, before allocating.

Affected packages

Ecosystem Package Introduced Fixed