Out-of-bounds write in Linux kernel - CVE-2026-93077

Vulnerability details

The vulnerability allows a local user to write beyond the feature output buffer.

The vulnerability exists due to improper bounds checking in cxl_get_feature() when a CXL device returns more feature data than requested during a partial read iteration. A local user can cause a CXL device to return more feature data than requested to write beyond the feature output buffer.

Affected software

How to mitigate CVE-2026-93077

External References

• https://git.kernel.org/stable/c/2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83
• https://git.kernel.org/stable/c/b8abbd5c2928fd839dab702244cc57b228ab43aa
• https://git.kernel.org/stable/c/ca95b15a0760e7724e61addbdd61050be13b6406

Related Security Bulletins

• Out-of-bounds write in Linux kernel cxl core driver