{"id":"CVE-2026-93079","summary":"cxl/features: Reject Get Feature count larger than the output buffer","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Reject Get Feature count larger than the output buffer\n\ncxlctl_get_feature() sizes its output buffer from the user's\nfwctl_rpc.out_len, but the device is told to write\ncxl_mbox_get_feat_in.count bytes into rpc_out-\u003epayload, which is a\nseparate user-controlled value. Nothing bounds count against out_len, so\na small out_len with a large count overflows the kvzalloc()'d buffer.\nA heap OOB write reachable from FWCTL_RPC.\n\nReject requests where count exceeds the available payload room, before\nallocating.","modified":"2026-09-20T11:30:18.677875892Z","published":"2026-09-17T16:11:00.350Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93079.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/329ea475581c647a680a6937e353c1a6e2534b40"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3f02031a0a53de0d3ef066c92d0486b2b11be40c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4bf6bac375076ced2fa4b3fef8739bd985f93456"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93079.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93079"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5908f3ed6dc209e5c824e63afda7545805f75a7e"},{"fixed":"3f02031a0a53de0d3ef066c92d0486b2b11be40c"},{"fixed":"329ea475581c647a680a6937e353c1a6e2534b40"},{"fixed":"4bf6bac375076ced2fa4b3fef8739bd985f93456"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93079.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.15.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93079.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}