CVE-2026-23327: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23327 Overview

CVE-2026-23327 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's Compute Express Link (CXL) mailbox subsystem. The flaw resides in cxl_payload_from_user_allowed() within drivers/cxl/core/mbox.c, which casts and dereferences a user-supplied payload without first validating its size. A local user issuing a raw mailbox command with an undersized payload, such as 1 byte for CXL_MBOX_OP_CLEAR_LOG which expects a 16-byte UUID, can trigger uuid_equal() to read past the allocated buffer. The condition produces a KASAN slab-out-of-bounds report and can lead to kernel information disclosure or denial of service on systems exposing CXL memory devices.

Critical Impact
Local attackers with access to a CXL memdev character device can trigger an out-of-bounds kernel read, leading to information disclosure or system crash.

Affected Products

Linux Kernel 5.19 and later branches containing the CXL mailbox code
Linux Kernel 7.0 release candidates (rc1 through rc7)
Distributions shipping vulnerable CXL driver builds in drivers/cxl/core/mbox.c

Discovery Timeline

2026-03-25 - CVE-2026-23327 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-23327

Vulnerability Analysis

The vulnerability lives in the CXL mailbox command handling path. When user space submits a raw mailbox command through the CXL memdev ioctl interface, the kernel routes the request through cxl_send_cmd() and cxl_validate_cmd_from_user() into cxl_mbox_cmd_ctor(). That constructor calls cxl_payload_from_user_allowed() to inspect the input payload for certain opcodes such as CXL_MBOX_OP_CLEAR_LOG.

The helper casts the user buffer to a typed structure and calls uuid_equal() against the contained UUID field. The function does not check that the supplied input length covers the expected 16-byte UUID. Submitting a 1-byte payload causes memcmp() inside uuid_equal() to read 8 bytes past the allocated slab object, as captured by the KASAN report referencing lib/string.c:683.

The attack is local and requires the ability to open a CXL memdev node and invoke its ioctl. Successful exploitation yields kernel-memory disclosure adjacent to the allocation or panics the system when KASAN or hardened allocators are configured to halt on detection.

Root Cause

The root cause is missing input validation. cxl_payload_from_user_allowed() trusts the caller-supplied payload size and dereferences typed fields before confirming that the buffer is large enough to contain them. This is a textbook out-of-bounds read driven by an unchecked length contract between user space and the kernel.

Attack Vector

A local user with permission to access the CXL memdev character device issues an ioctl carrying a raw mailbox command. The attacker selects an opcode that cxl_payload_from_user_allowed() inspects, such as CXL_MBOX_OP_CLEAR_LOG, and supplies an undersized in_size. The kernel reads beyond the user-derived allocation, exposing adjacent slab content or triggering a fault.

The vulnerability mechanism is described in the upstream commits referenced below; no public proof-of-concept exploit is listed in the advisory data.

Detection Methods for CVE-2026-23327

Indicators of Compromise

KASAN reports in dmesg showing slab-out-of-bounds in memcmp with a call trace through uuid_equal, cxl_payload_from_user_allowed, and cxl_send_cmd
Unexpected oops or panic logs originating from drivers/cxl/core/mbox.c
Repeated ioctl calls on /dev/cxl/mem* devices from unprivileged or unexpected processes

Detection Strategies

Audit kernel logs for KASAN or general protection fault entries referencing the CXL mailbox call chain
Enable kernel auditd rules to record ioctl operations against /dev/cxl/mem* nodes and review for non-administrative callers
Compare running kernel build identifiers and module versions against patched commit hashes 60b5d1f6 and 7c8a7b7f

Monitoring Recommendations

Forward kernel ring buffer and auditd events to a centralized logging or SIEM platform for correlation
Alert on any process accessing CXL memdev devices outside of approved management tooling
Track kernel package versions across the fleet and flag hosts running unpatched CXL-capable kernels

How to Mitigate CVE-2026-23327

Immediate Actions Required

Apply the upstream Linux kernel patches that add an in_size parameter to cxl_payload_from_user_allowed() and validate payload length before access
Restrict access to /dev/cxl/mem* character devices to trusted administrative users and services
Inventory systems with CXL-capable hardware or kernel modules and prioritize them for kernel updates

Patch Information

The fix introduces an in_size argument to cxl_payload_from_user_allowed() and verifies that the payload is large enough before dereferencing typed fields. The corrections are committed upstream in Kernel Git Commit #60b5d1f and Kernel Git Commit #7c8a7b7. Rebuild or upgrade to a kernel release containing both commits.

Workarounds

Unload or blacklist the cxl_core and related CXL modules on systems that do not require CXL functionality
Tighten file permissions and udev rules on CXL memdev nodes so only root or a dedicated management group can issue ioctl calls
Disable CXL support in BIOS or firmware on hosts where the feature is not in use

bash

# Configuration example: restrict CXL memdev access and blacklist module where unused
echo 'blacklist cxl_mem'  | sudo tee /etc/modprobe.d/cxl-mitigation.conf
echo 'blacklist cxl_pci'  | sudo tee -a /etc/modprobe.d/cxl-mitigation.conf
echo 'blacklist cxl_core' | sudo tee -a /etc/modprobe.d/cxl-mitigation.conf

# Limit ioctl access to root only via udev
cat <<'EOF' | sudo tee /etc/udev/rules.d/90-cxl.rules
KERNEL=="cxl*", SUBSYSTEM=="cxl", MODE="0600", OWNER="root", GROUP="root"
EOF

sudo udevadm control --reload-rules && sudo udevadm trigger