{"id":"CVE-2026-93078","revision":"dc81a191bc2d45c18400b9da00d03092","records":[{"revision":"dc81a191bc2d45c18400b9da00d03092","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93078","aliases":[],"title":"cxl/features: Reject Set Features output buffer smaller than the header","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Reject Set Features output buffer smaller than the header\n\ncxlctl_set_feature() sizes its output buffer from the user's\nfwctl_rpc.out_len but never checks it is large enough to hold even the\nfwctl_rpc_cxl_out header. With out_len == 0 , kvzalloc() returns\nZERO_SIZE_PTR, which passes the !rpc_out check, the subsequent\nrpc_out->size = 0 then writes through the poison pointer.\n\nReject requests whose output buffer can't hold the response header,\nbefore allocating. The Set Feature reply carries no payload, so the\nheader is all that is required.","state":0,"publishedAt":"2026-09-17T16:10:59.686+00:00","modifiedAt":"2026-10-19T09:05:14.083+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/cxl/core/features.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"eb5dfcb9e36d0e46089fec777d911313c1876fa3\",\n                            \"lessThan\": \"1281dc84c81577b51e2b61c24617c9f44b2cdb99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eb5dfcb9e36d0e46089fec777d911313c1876fa3\",\n                            \"lessThan\": \"16b7c99eff030c6ea11ca24efa4b9f989cc74093\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eb5dfcb9e36d0e46089fec777d911313c1876fa3\",\n                            \"lessThan\": \"cde18d6c1d913a67ab0afd3d9475ece4be79da50\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/cxl/core/features.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/1281dc84c81577b51e2b61c24617c9f44b2cdb99","https://git.kernel.org/stable/c/16b7c99eff030c6ea11ca24efa4b9f989cc74093","https://git.kernel.org/stable/c/cde18d6c1d913a67ab0afd3d9475ece4be79da50"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93078","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93078","identifiers":["CVE-2026-93078"]},"retained":false,"historicalAffected":[]}],"coverage":[]}