CVE-2026-89571

In the Linux kernel, the following vulnerability has been resolved:

cxl/features: bound fwctl command payload to the input buffer

fwctl cmd rpc() copies cmd->in len bytes into inbuf = kvzalloc(cmd->in len) and passes inbuf and in len to ->fw rpc(). The CXL callback cxlctl fw rpc() ignores in len and never checks the user-controlled op size against it.

cxlctl set feature() bounds op size only from below (op size <= sizeof(feat in->hdr)) and then reads op size - sizeof(hdr) bytes from feat in->feat data via cxl set feature(). With a small in len and a large op size the first memcpy() already reads past the kvzalloc(in len) buffer; the out-of-bounds bytes are placed in the mailbox payload and sent to the device, and a large enough op size can walk into unmapped memory and oops the kernel. The Get paths pin op size to a fixed size but likewise read the input struct without checking in len.

Reject, at the single dispatch point, any request whose fixed header plus op size does not fit in the copied-in buffer. The lower-bound test guards the subtraction and ensures op size was copied in before it is read.