CVE-2026-89571

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the CXL features of the Linux kernel where the cxlctl fw rpc() callback fails to validate the user-controlled op size variable against the input buffer length in len. In the cxlctl set feature() function, op size is only bounded from below. If a small in len is provided alongside a large op size, the system performs a memory copy that reads past the allocated kvzalloc(in len) buffer. This out-of-bounds read places unauthorized data into the mailbox payload sent to the device and can lead to a kernel oops if the read extends into unmapped memory. Similarly, the Get paths read the input structure without verifying in len.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.