CVE-2026-89571

The Linux kernel's CXL fwctl RPC path fails to validate the user-controlled op_size against the length of the buffer copied in from userspace (in_len), allowing an out-of-bounds read past a kvzalloc'd input buffer. A local attacker with access to the fwctl interface can trigger the flaw by issuing a set-feature request with a small in_len but a large op_size; the out-of-bounds kernel memory bytes are copied into the CXL mailbox payload and sent to the device, and a large enough op_size can walk into unmapped memory and oops (crash) the kernel. This yields high confidentiality impact (kernel memory disclosure to the device) and high availability impact via denial of service, with no integrity impact. Affected systems are those running kernels containing the cxl/features fwctl code path with CXL-attached devices, and exploitation requires local access with privileges sufficient to reach the fwctl character device. No public proof of concept or exploitation in the wild is known, and the issue is not on the CISA KEV list.

What to do: Upgrade to a kernel release containing the upstream fix, which rejects at the single dispatch point any fwctl request whose fixed header plus op_size does not fit within the copied-in input buffer. As defense in depth, confirm that /dev/fwctl device nodes remain restricted to privileged users (the default), since exploitation requires local access through that interface. Review kernel logs for oopses or panics referencing fwctl/cxlctl_fw_rpc on hosts with CXL devices in use.