CVE-2026-89571

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cxl/features: bound fwctl command payload to the input buffer

fwctl_cmd_rpc() copies cmd->in_len bytes into inbuf = kvzalloc(cmd->in_len)

and passes inbuf and in_len to ->fw_rpc(). The CXL callback cxlctl_fw_rpc()

ignores in_len and never checks the user-controlled op_size against it.

cxlctl_set_feature() bounds op_size only from below

(op_size <= sizeof(feat_in->hdr)) and then reads op_size - sizeof(hdr)

bytes from feat_in->feat_data via cxl_set_feature(). With a small in_len

and a large op_size the first memcpy() already reads past the

kvzalloc(in_len) buffer; the out-of-bounds bytes are placed in the mailbox

payload and sent to the device, and a large enough op_size can walk into

unmapped memory and oops the kernel. The Get paths pin op_size to a fixed

size but likewise read the input struct without checking in_len.

Reject, at the single dispatch point, any request whose fixed header plus

op_size does not fit in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References