CVE-2026-89571: Linux Kernel CXL Buffer Overflow Vulnerability

CVE-2026-89571 Overview

CVE-2026-89571 is an out-of-bounds read vulnerability in the Linux kernel Compute Express Link (CXL) features subsystem. The flaw resides in the fwctl_cmd_rpc() dispatch path, where the CXL callback cxlctl_fw_rpc() fails to validate the user-controlled op_size field against the length of the copied-in buffer. A local user with access to the fwctl interface can trigger reads past a kvzalloc(in_len) allocation, leaking out-of-bounds memory into the mailbox payload sent to the device or crashing the kernel when the read walks into unmapped memory.

Critical Impact
Local users can trigger kernel out-of-bounds reads that leak memory to CXL devices or cause a denial of service via kernel oops.

Affected Products

Linux kernel with CXL features and fwctl support enabled
Distributions shipping the vulnerable cxlctl_fw_rpc() and cxlctl_set_feature() code paths
Systems exposing the fwctl RPC interface to unprivileged or semi-privileged users

Discovery Timeline

2026-09-11 - CVE-2026-89571 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89571

Vulnerability Analysis

The vulnerability originates in the interaction between the generic fwctl dispatcher and the CXL features backend. fwctl_cmd_rpc() allocates an input buffer with inbuf = kvzalloc(cmd->in_len) and copies cmd->in_len bytes from userspace into it. It then passes inbuf and in_len to the driver-specific ->fw_rpc() handler.

The CXL implementation, cxlctl_fw_rpc(), ignores the in_len argument. It reads a user-controlled op_size from the command structure and does not verify that the fixed header plus op_size fits inside the copied-in buffer.

In the Set path, cxlctl_set_feature() bounds op_size only from below with op_size <= sizeof(feat_in->hdr). It then reads op_size - sizeof(hdr) bytes from feat_in->feat_data through cxl_set_feature(). When in_len is small and op_size is large, the first memcpy() reads past the kvzalloc(in_len) allocation. The Get paths pin op_size to a fixed size but still read the input structure without validating in_len.

Root Cause

The root cause is missing input validation at the dispatch boundary between fwctl and the CXL backend. The CXL callback trusts an attacker-controlled length field (op_size) without cross-checking it against the actual size of the buffer copied in from userspace. This is a classic out-of-bounds read primitive driven by inconsistent length tracking.

Attack Vector

Exploitation requires local access with permissions to issue fwctl RPC commands to a CXL device. An attacker crafts a command whose in_len is small while op_size in the payload header is large. The kernel then reads adjacent heap memory into the mailbox buffer transmitted to the CXL device, disclosing kernel data. A sufficiently large op_size can cross into unmapped memory and panic the kernel, producing a denial of service. No code examples are published beyond the upstream patches referenced below.

Detection Methods for CVE-2026-89571

Indicators of Compromise

Unexpected kernel oops messages referencing cxlctl_fw_rpc, cxlctl_set_feature, or cxl_set_feature in dmesg or the system journal
Repeated failed fwctl RPC invocations from non-administrative accounts targeting CXL character devices
Unusual CXL mailbox traffic containing payloads whose declared op_size exceeds the caller-provided input length

Detection Strategies

Audit process access to /dev/cxl/* and fwctl character devices, correlating access with the process, user, and command lineage
Deploy kernel address sanitizer (KASAN) builds in test environments to surface out-of-bounds reads originating in the CXL features code path
Monitor kernel crash telemetry for panics whose backtrace includes CXL fwctl symbols following userspace RPC activity

Monitoring Recommendations

Forward auditd and kernel logs to a central platform for correlation of CXL device access and kernel fault events
Alert on newly loaded or modified cxl_core, cxl_pci, and related CXL kernel modules on production hosts
Track userspace processes that open fwctl device nodes and issue RPC ioctls, especially outside change windows

How to Mitigate CVE-2026-89571

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 14d52c15, d8957545, and f687394a
Restrict access to fwctl and CXL device nodes to trusted administrative accounts only
Inventory hosts with CXL-attached devices and prioritize patch deployment on those systems

Patch Information

The upstream fix rejects any request whose fixed header plus op_size does not fit in the copied-in buffer, performed at the single dispatch point in cxlctl_fw_rpc(). The lower-bound check guards the subtraction and ensures op_size was itself copied in before it is read. Consult the stable tree commits listed above and follow your Linux distribution's advisory channel for backported package versions.

Workarounds

Unload or blacklist the CXL features module on systems that do not require CXL fwctl functionality
Enforce strict file permissions and Mandatory Access Control (SELinux or AppArmor) rules on fwctl and CXL character devices to block untrusted local users
Disable exposure of the fwctl RPC interface to containers and unprivileged workloads until patches are deployed

bash

# Configuration example: restrict access to CXL device nodes
chown root:root /dev/cxl/*
chmod 0600 /dev/cxl/*

# Prevent automatic loading of the CXL features module if unused
echo 'blacklist cxl_core' | sudo tee /etc/modprobe.d/blacklist-cxl.conf
sudo update-initramfs -u