CVE-2026-93077cxl/features: Clamp Get Feature output size to the remaining buffer
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out. Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5e5ac21f629de796ab5d598b59c5e468c6fe4f95 before b8abbd5c2928fd839dab702244cc57b228ab43aa; from 5e5ac21f629de796ab5d598b59c5e468c6fe4f95 before ca95b15a0760e7724e61addbdd61050be13b6406; 5e5ac21f629de796ab5d598b59c5e468c6fe4f95 builds before 2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83 | CNA record |
References
- https://git.kernel.org/stable/c/b8abbd5c2928fd839dab702244cc57b228ab43aa
- https://git.kernel.org/stable/c/ca95b15a0760e7724e61addbdd61050be13b6406
- https://git.kernel.org/stable/c/2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.