CVE-2026-93079

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap out-of-bounds write exists in the cxlctl get feature() function. The issue occurs because the output buffer is sized based on the fwctl rpc.out len value provided by the user, while the device is instructed to write a number of bytes specified by cxl mbox get feat in.count, which is also user-controlled. Since there is no validation to ensure count does not exceed out len, a small out len combined with a large count can overflow the buffer allocated via kvzalloc(). This flaw is reachable from FWCTL RPC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.