CVE-2026-89731

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read

cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from

the RCRB MMIO block using a readl() loop bounded by sizeof(struct

aer_capability_regs). This struct is a software layout and its embedded

struct pcie_tlp_log is larger than the on-wire AER capability. As a

result the loop reads past the mapped AER register block.

The over-read also populates the software-only tail fields including

header_log.header_len. An out-of-range header_len passed to

pcie_print_tlp_log() can then loop past the header log buffer and cause

a second out-of-bounds read.

The read was correct when introduced, but struct pcie_tlp_log has since

grown (Header Log and TLP Prefix Log sizes, header_len and flit fields),

so sizeof(struct aer_capability_regs) no longer matches the physical AER

capability.

Bound the read to the physical AER registers, header through

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References