CVE-2026-93078

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the cxlctl set feature() function where the output buffer size is determined by the user-provided fwctl rpc.out len without verifying if it is large enough to accommodate the fwctl rpc cxl out header. When out len is set to 0, kvzalloc() returns a ZERO SIZE PTR, which bypasses the !rpc out check. This leads to a write operation through a poison pointer when rpc out->size is assigned a value of 0.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.