CVE-2026-23327
Out-of-Bounds Read in Linux Kernel CXL Mailbox Payload Validation
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.19 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.19.1 (inc) to 6.19.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's cxl/mbox component, specifically in the function cxl_payload_from_user_allowed(). The function casts and dereferences an input payload without first verifying its size. If a raw mailbox command is sent with an undersized payload (for example, 1 byte instead of the expected 16-byte UUID for the CXL_MBOX_OP_CLEAR_LOG operation), the function uuid_equal() reads beyond the allocated buffer. This causes a kernel memory out-of-bounds read, triggering a Kernel Address Sanitizer (KASAN) error.
The issue was fixed by adding an 'in_size' parameter to the function and validating that the payload is large enough before accessing its contents.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to perform out-of-bounds memory reads, which may lead to system instability or crashes due to the KASAN slab-out-of-bounds error. Such behavior can disrupt normal system operations and potentially be exploited to leak sensitive kernel memory contents or cause denial of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel memory out-of-bounds read triggered by sending a raw mailbox command with an undersized payload to the Linux kernel's cxl subsystem.
Detection can involve monitoring kernel logs for KASAN (Kernel Address Sanitizer) slab-out-of-bounds errors related to memcmp or uuid_equal functions, which indicate attempts to exploit this vulnerability.
Specifically, look for log entries similar to: "BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683".
Commands to check kernel logs include:
- dmesg | grep -i kasan
- journalctl -k | grep -i kasan
- grep -i 'slab-out-of-bounds' /var/log/kern.log
Additionally, monitoring for unusual ioctl calls to the cxl_memdev device or raw mailbox commands with undersized payloads could help detect exploitation attempts, but specific commands for this are not provided.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to update the Linux kernel to a version that includes the fix for this vulnerability, which adds payload size validation in the cxl_payload_from_user_allowed() function.
Until the kernel is updated, consider restricting access to the cxl mailbox interface to trusted users only, as exploitation requires sending crafted raw mailbox commands.
Monitoring kernel logs for KASAN errors can also help detect exploitation attempts early.