CVE-2026-93077

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out. Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83
https://git.kernel.org/stable/c/b8abbd5c2928fd839dab702244cc57b228ab43aa
https://git.kernel.org/stable/c/ca95b15a0760e7724e61addbdd61050be13b6406

Configurations

No configuration.

History

17 Sep 2026, 17:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:18

Updated : 2026-09-17 17:18

NVD link : CVE-2026-93077

Mitre link : CVE-2026-93077

CVE.ORG link : CVE-2026-93077

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-93077", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5e5ac21f629de796ab5d598b59c5e468c6fe4f95", "lessThan": "b8abbd5c2928fd839dab702244cc57b228ab43aa", "versionType": "git"}, {"status": "affected", "version": "5e5ac21f629de796ab5d598b59c5e468c6fe4f95", "lessThan": "ca95b15a0760e7724e61addbdd61050be13b6406", "versionType": "git"}, {"status": "affected", "version": "5e5ac21f629de796ab5d598b59c5e468c6fe4f95", "lessThan": "2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83", "versionType": "git"}], "programFiles": ["drivers/cxl/core/features.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.52", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.6", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/cxl/core/features.c"], "defaultStatus": "affected"}]}], "published": "2026-09-17T17:18:01.643", "references": [{"url": "https://git.kernel.org/stable/c/2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b8abbd5c2928fd839dab702244cc57b228ab43aa", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ca95b15a0760e7724e61addbdd61050be13b6406", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Clamp Get Feature output size to the remaining buffer\n\ncxl_get_feature() reads a feature in a loop but passes a fixed size_out\nas the output capacity every iteration. On the last partial iteration\nthe buffer has less room left, so a device that returns more than asked\ncan overflow feat_out.\n\nUse the per-iter size data_to_rd_size, which already tracks the\nremaining room, as the output capacity."}], "lastModified": "2026-09-17T17:18:01.643", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}