CVE-2026-64101 Overview
CVE-2026-64101 is a Linux kernel vulnerability in the fwctl subsystem's pds driver. The flaw exists in pdsfc_fw_rpc(), which casts a user-supplied RPC input buffer to struct fwctl_rpc_pds and reads its fields before verifying that the buffer is large enough to contain the structure. A short in_len value passed through fwctl_rpc causes pdsfc_validate_rpc() to read past the end of the allocation. The upstream fix rejects any pds RPC buffer smaller than struct fwctl_rpc_pds before parsing driver-specific fields. The issue affects Linux kernel branches shipping the pds_fwctl driver.
Critical Impact
Local users with access to the fwctl character device can trigger an out-of-bounds read in kernel memory by submitting an undersized RPC input buffer.
Affected Products
- Linux kernel branches containing the pds_fwctl driver
- Distributions shipping the affected kernel builds without the upstream fix
- Systems exposing fwctl device nodes to unprivileged or semi-privileged users
Discovery Timeline
- 2026-07-19 - CVE-2026-64101 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64101
Vulnerability Analysis
The fwctl core allocates an RPC input buffer sized by the user-controlled fwctl_rpc.in_len field and passes that buffer directly to the driver callback. In pdsfc_fw_rpc(), the buffer pointer is cast to struct fwctl_rpc_pds and forwarded to pdsfc_validate_rpc(). That validator dereferences members of the structure before confirming the allocation is at least sizeof(struct fwctl_rpc_pds) bytes long. When a caller supplies an in_len smaller than the structure size, the driver reads memory beyond the allocated buffer, producing an out-of-bounds read [CWE-125].
The patch reorders the checks so that the length comparison runs first, and any RPC buffer shorter than the pds header is rejected before its fields are parsed. This is a defensive input-validation fix aligned with standard kernel driver hardening practice.
Root Cause
The root cause is missing input-size validation before structure parsing. pdsfc_validate_rpc() trusted that the buffer provided by the fwctl core matched the layout of struct fwctl_rpc_pds, without verifying that in_len covered the full structure. The buffer size is fully attacker-controlled through the ioctl interface.
Attack Vector
A local user with permission to open the fwctl device node and issue RPC ioctls can craft a request where in_len is smaller than sizeof(struct fwctl_rpc_pds). The driver then reads adjacent kernel heap memory when interpreting the truncated structure. Consequences include kernel information disclosure and potential downstream logic errors driven by uninitialized field values. The vulnerability requires local access to a system exposing pds_fwctl and does not, by itself, provide arbitrary write primitives.
No public proof-of-concept code is available. See the upstream commits referenced below for the exact code changes: kernel commit 0d470d36, kernel commit 9e3f1888, and kernel commit e7537735.
Detection Methods for CVE-2026-64101
Indicators of Compromise
- Unexpected processes opening /dev/fwctl/* device nodes on systems with AMD Pensando DSC hardware.
- Kernel log entries from KASAN, if enabled, reporting out-of-bounds reads inside pdsfc_validate_rpc or pdsfc_fw_rpc.
- Anomalous ioctl activity targeting fwctl RPC handlers from non-administrative user contexts.
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) in test builds to catch the out-of-bounds read at runtime during fuzzing or QA.
- Audit which local accounts and containers have read/write access to fwctl character devices, and alert on new grants.
- Deploy eBPF or auditd rules that record ioctl calls against fwctl device nodes with the parameters used.
Monitoring Recommendations
- Track kernel version and pds driver patch state across the fleet and flag hosts still running vulnerable builds.
- Monitor dmesg and journal output for pds_fwctl warnings, oops entries, or KASAN reports.
- Correlate local privilege events with fwctl device access to surface unexpected users interacting with the driver.
How to Mitigate CVE-2026-64101
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry and rebuild or update affected kernels.
- Restrict permissions on fwctl device nodes so that only trusted administrative accounts can issue RPC ioctls.
- Unload or blacklist the pds_fwctl module on systems that do not require AMD Pensando DSC firmware control.
Patch Information
The fix is present in the mainline and stable Linux kernel trees via commits 0d470d36551058e3f728574308b815a80bca710f, 9e3f18883a98420a3b8873c6f894bc57e9b98e41, and e7537735028c3ad4b0bfc02ff8fa2a1a28aa04fe. The patch validates that the RPC input buffer is at least sizeof(struct fwctl_rpc_pds) before parsing pds-specific fields. Distribution vendors are expected to backport the fix to supported long-term kernels.
Workarounds
- Blacklist the pds_fwctl kernel module on systems that do not use AMD Pensando firmware control functionality.
- Tighten Unix permissions and udev rules on /dev/fwctl/* nodes so only root can open them.
- Use container and namespace policies to prevent workloads from accessing fwctl device nodes.
# Configuration example: blacklist pds_fwctl and restrict device node access
echo 'blacklist pds_fwctl' | sudo tee /etc/modprobe.d/blacklist-pds-fwctl.conf
sudo rmmod pds_fwctl 2>/dev/null || true
# Restrict fwctl device nodes to root only via udev
cat <<'EOF' | sudo tee /etc/udev/rules.d/90-fwctl.rules
KERNEL=="fwctl*", MODE="0600", OWNER="root", GROUP="root"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
