CVE-2026-89731
nicheOut-of-bounds MMIO read in Linux kernel CXL RCH AER error handling
The Linux kernel's CXL RAS subsystem contains an out-of-bounds read in cxl_rach_get_aer_info(), which copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aer_capability_regs) — a software layout that, after struct pcie_tlp_log grew over time, is larger than the physical AER capability, so the loop reads past the mapped AER register block. The over-read also populates software-only fields, including header_log.header_len, and an out-of-range header_len passed to pcie_print_tlp_log() causes a second out-of-bounds read past the header log buffer. The flaw is triggered whenever the kernel services an AER error on a Restricted CXL Host (RCH) downstream port, meaning systems running CXL devices in RCH/RCRB topologies. A local attacker with some privileges could leverage the over-reads to expose kernel memory contents via logged output (C:H) or crash the system (A:H), consistent with CVSS 3.1 7.1 (AV:L/AC:L/PR:L). No public proof of concept exists, the flaw is not in CISA's KEV, and an upstream fix that bounds the read to the physical AER registers is already committed.
What to do: Update to a kernel containing the cxl/ras fix (the read is bounded to the physical AER registers, header through the 16-byte Header Log, with the destination zeroed first), and watch your vendor's stable branches for backports if you run CXL RCH systems. Because exploitation requires local access with privileges, restrict local shell access on CXL hosts until patched, and review kernel logs after AER events for anomalous TLP header log output as a possible indicator.
| Linux kernel (cxl/ras RCH AER handling, cxl_rach_get_aer_info()) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aer_capability_regs). This struct is a software layout and its embedded struct pcie_tlp_log is larger than the on-wire AER capability. As a result the loop reads past the mapped AER register block. The over-read also populates the software-only tail fields including header_log.header_len. An out-of-range header_len passed to pcie_print_tlp_log() can then loop past the header log buffer and cause a second out-of-bounds read. The read was correct when introduced, but struct pcie_tlp_log has since grown (Header Log and TLP Prefix Log sizes, header_len and flit fields), so sizeof(struct aer_capability_regs) no longer matches the physical AER capability. Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic.
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.