CVE-2026-93079 (GCVE-0-2026-93079)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:11 – Updated: 2026-09-18 17:55
VLAI
Title
cxl/features: Reject Get Feature count larger than the output buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len, but the device is told to write cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTL_RPC. Reject requests where count exceeds the available payload room, before allocating.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5908f3ed6dc209e5c824e63afda7545805f75a7e , < 3f02031a0a53de0d3ef066c92d0486b2b11be40c (git)
Affected: 5908f3ed6dc209e5c824e63afda7545805f75a7e , < 329ea475581c647a680a6937e353c1a6e2534b40 (git)
Affected: 5908f3ed6dc209e5c824e63afda7545805f75a7e , < 4bf6bac375076ced2fa4b3fef8739bd985f93456 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/features.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f02031a0a53de0d3ef066c92d0486b2b11be40c",
              "status": "affected",
              "version": "5908f3ed6dc209e5c824e63afda7545805f75a7e",
              "versionType": "git"
            },
            {
              "lessThan": "329ea475581c647a680a6937e353c1a6e2534b40",
              "status": "affected",
              "version": "5908f3ed6dc209e5c824e63afda7545805f75a7e",
              "versionType": "git"
            },
            {
              "lessThan": "4bf6bac375076ced2fa4b3fef8739bd985f93456",
              "status": "affected",
              "version": "5908f3ed6dc209e5c824e63afda7545805f75a7e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/features.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Reject Get Feature count larger than the output buffer\n\ncxlctl_get_feature() sizes its output buffer from the user\u0027s\nfwctl_rpc.out_len, but the device is told to write\ncxl_mbox_get_feat_in.count bytes into rpc_out-\u003epayload, which is a\nseparate user-controlled value. Nothing bounds count against out_len, so\na small out_len with a large count overflows the kvzalloc()\u0027d buffer.\nA heap OOB write reachable from FWCTL_RPC.\n\nReject requests where count exceeds the available payload room, before\nallocating."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is triggered by ioctl(FWCTL_RPC) on /dev/fwctl/fwctlN via fwctl_fops_ioctl()-\u003efwctl_cmd_rpc()-\u003ecxlctl_fw_rpc()-\u003ecxlctl_get_feature(). The mismatched inputs are local userspace fields fwctl_rpc.out_len and cxl_mbox_get_feat_in.count on a CXL_MBOX_OP_GET_FEATURE (0x0501) RPC, not bytes from a network or CXL-peer protocol message.\nAC:L - The caller sets both fwctl_rpc.out_len and get_feat_in.count in one GET_FEATURE RPC. cxlctl_get_feature() kvzallocs out_len then passes count to cxl_get_feature() as the mailbox output length, so a short out_len with count larger than the payload room overflows on memcpy_fromio() in __cxl_pci_mbox_send_cmd(). Feature size is learned first via GET_SUPPORTED_FEATURES; no race is required.\nPR:L - CXL_MBOX_OP_GET_FEATURE is accepted at FWCTL_RPC_CONFIGURATION; fwctl_cmd_rpc() checks CAP_SYS_RAWIO only for FWCTL_RPC_DEBUG_WRITE_FULL, and cxlctl_open_uctx() is a no-op. Opening /dev/fwctl/fwctlN is sufficient, and that node is routinely granted to management/VMM users without init-namespace root.\nUI:N - The attacker opens /dev/fwctl/fwctlN and issues ioctl(FWCTL_RPC) with opcode CXL_MBOX_OP_GET_FEATURE themselves; no victim action such as mounting a volume or opening a file is required.\nS:U - __cxl_pci_mbox_send_cmd() memcpy_fromio()s the Get Feature mailbox payload into the host kernel heap object rpc_out-\u003epayload allocated by cxlctl_get_feature(). The corruption stays in the host kernel CXL/fwctl path and is not a guest-to-host, IOMMU, or other changed-scope boundary.\nC:H - cxl_get_feature() tells the device to write get_feat_in.count bytes (u16, up to 65535) into rpc_out-\u003epayload, overflowing the kvzalloc(out_len) object via memcpy_fromio(). That heap out-of-bounds write is memory corruption that can be turned into an arbitrary-read primitive.\nI:H - The same GET_FEATURE path is a kernel heap out-of-bounds write: __cxl_pci_mbox_send_cmd() copies the mailbox payload into feat_out past the end of the out_len-sized allocation. The attacker chooses count and can SET_FEATURE first on a changeable user feature, so adjacent heap objects can be overwritten.\nA:H - Overflowing the kvzalloc buffer in cxlctl_get_feature() corrupts adjacent heap metadata and oopses, and out_len==0 makes kvzalloc return ZERO_SIZE_PTR so the mailbox write through rpc_out-\u003epayload faults immediately. Either outcome is a repeatable kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:55:53.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f02031a0a53de0d3ef066c92d0486b2b11be40c"
        },
        {
          "url": "https://git.kernel.org/stable/c/329ea475581c647a680a6937e353c1a6e2534b40"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bf6bac375076ced2fa4b3fef8739bd985f93456"
        }
      ],
      "title": "cxl/features: Reject Get Feature count larger than the output buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93079",
    "datePublished": "2026-09-17T16:11:00.350Z",
    "dateReserved": "2026-09-17T15:57:05.661Z",
    "dateUpdated": "2026-09-18T17:55:53.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93079",
      "date": "2026-09-29",
      "epss": "0.00173",
      "percentile": "0.06027"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/cxl/core/features.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3f02031a0a53de0d3ef066c92d0486b2b11be40c",
                    "status": "affected",
                    "version": "5908f3ed6dc209e5c824e63afda7545805f75a7e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "329ea475581c647a680a6937e353c1a6e2534b40",
                    "status": "affected",
                    "version": "5908f3ed6dc209e5c824e63afda7545805f75a7e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4bf6bac375076ced2fa4b3fef8739bd985f93456",
                    "status": "affected",
                    "version": "5908f3ed6dc209e5c824e63afda7545805f75a7e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/cxl/core/features.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Reject Get Feature count larger than the output buffer\n\ncxlctl_get_feature() sizes its output buffer from the user\u0027s\nfwctl_rpc.out_len, but the device is told to write\ncxl_mbox_get_feat_in.count bytes into rpc_out-\u003epayload, which is a\nseparate user-controlled value. Nothing bounds count against out_len, so\na small out_len with a large count overflows the kvzalloc()\u0027d buffer.\nA heap OOB write reachable from FWCTL_RPC.\n\nReject requests where count exceeds the available payload room, before\nallocating."
          }
        ],
        "id": "CVE-2026-93079",
        "lastModified": "2026-09-18T18:18:20.330",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:18:01.850",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/329ea475581c647a680a6937e353c1a6e2534b40"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3f02031a0a53de0d3ef066c92d0486b2b11be40c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4bf6bac375076ced2fa4b3fef8739bd985f93456"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-23T00:14:06Z",
      "cve": "CVE-2026-93079",
      "id": "CVE-2026-93079",
      "initial_release_date": "2026-09-18T00:12:32Z",
      "product_status:known_not_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93079",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93079.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.