CVE-2026-89571

Received Received - Intake

Buffer Overflow in Linux Kernel CXL Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctl_cmd_rpc() copies cmd->in_len bytes into inbuf = kvzalloc(cmd->in_len) and passes inbuf and in_len to ->fw_rpc(). The CXL callback cxlctl_fw_rpc() ignores in_len and never checks the user-controlled op_size against it. cxlctl_set_feature() bounds op_size only from below (op_size <= sizeof(feat_in->hdr)) and then reads op_size - sizeof(hdr) bytes from feat_in->feat_data via cxl_set_feature(). With a small in_len and a large op_size the first memcpy() already reads past the kvzalloc(in_len) buffer; the out-of-bounds bytes are placed in the mailbox payload and sent to the device, and a large enough op_size can walk into unmapped memory and oops the kernel. The Get paths pin op_size to a fixed size but likewise read the input struct without checking in_len. Reject, at the single dispatch point, any request whose fixed header plus op_size does not fit in the copied-in buffer. The lower-bound test guards the subtraction and ensures op_size was copied in before it is read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89571

EUVD

EUVD-2026-76483

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper bounds checking in the CXL (Compute Express Link) feature handling. The issue occurs when the fwctl command payload is copied into a buffer without verifying that the input length matches the expected size. This allows an attacker to specify a large operation size that exceeds the allocated buffer, leading to out-of-bounds memory reads and potential kernel crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's CXL (Compute Express Link) feature handling. Detection requires checking kernel logs for crashes or oops messages related to CXL operations. Monitor for kernel panics or unexpected device errors during CXL feature set operations.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a denial-of-service (kernel crash) by triggering out-of-bounds memory reads. In severe cases, it might lead to arbitrary code execution, though this requires further exploitation steps. Systems using affected Linux kernel versions with CXL features enabled are at risk.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patches are unavailable, disable the CXL feature module (CONFIG_CXL) in the kernel configuration. Monitor vendor advisories for updates and test patches in a non-production environment before deployment.

Hi! I’m here to help you understand CVE-2026-89571. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70