CVE-2026-89731: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89731 Overview

CVE-2026-89731 is an out-of-bounds read vulnerability in the Linux kernel's Compute Express Link (CXL) Reliability, Availability, and Serviceability (RAS) subsystem. The flaw resides in cxl_rch_get_aer_info(), which copies the RCH Downstream Port Advanced Error Reporting (AER) capability from the Root Complex Register Block (RCRB) memory-mapped I/O region. A readl() loop bounded by sizeof(struct aer_capability_regs) reads past the mapped AER register block because the software-layout struct is larger than the on-wire AER capability.

Critical Impact
The over-read populates software-only fields including header_log.header_len, which can then drive a second out-of-bounds read inside pcie_print_tlp_log(), potentially disclosing adjacent kernel memory or destabilizing the host.

Affected Products

Linux kernel with CXL RAS support enabled (drivers/cxl/core/ras)
Stable kernel branches referenced by commits 29458e6, 8bd3523, and 8e3d9db
Systems exposing RCH Downstream Port AER capabilities via the CXL RCRB

Discovery Timeline

2026-09-11 - CVE-2026-89731 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89731

Vulnerability Analysis

The defect stems from a mismatch between a kernel software layout and the physical PCI Express AER capability. cxl_rch_get_aer_info() uses sizeof(struct aer_capability_regs) to bound a readl() loop that copies AER registers out of the RCRB MMIO block. That struct embeds struct pcie_tlp_log, which has grown over time to include additional Header Log entries, TLP Prefix Log storage, a header_len field, and a flit field. The physical AER capability on the device did not grow, so the loop now walks past the mapped register window.

Because the destination buffer is not zeroed before the copy, the over-read also seeds software-only tail fields with attacker-influenced or indeterminate MMIO values. When pcie_print_tlp_log() later consumes header_log.header_len, an out-of-range length causes the printer to iterate past the header log buffer, producing a second out-of-bounds read on kernel memory.

Root Cause

The root cause is a stale size assumption. The read was correct when introduced, but subsequent additions to struct pcie_tlp_log (Header Log and TLP Prefix Log sizing, plus header_len and flit fields) increased sizeof(struct aer_capability_regs) beyond the physical AER register block. The fix bounds the copy to the physical AER registers through the 16-byte Header Log and zero-initializes the destination so software-only fields remain deterministic.

Attack Vector

Exploitation requires local access with low privileges on a system that instantiates CXL RCH Downstream Port AER handling. A local actor able to influence AER-triggering events or the adjacent MMIO layout can reach the vulnerable code path, resulting in kernel information disclosure and potential system instability. No user interaction is required. Refer to the upstream commits for register-level detail: Kernel Git Commit 29458e6, Kernel Git Commit 8bd3523, and Kernel Git Commit 8e3d9db.

Detection Methods for CVE-2026-89731

Indicators of Compromise

Unexpected kernel oops or KASAN reports referencing cxl_rch_get_aer_info or pcie_print_tlp_log.
Malformed AER log entries in dmesg with implausible header lengths or truncated TLP prefixes.
Sporadic CXL RAS handler faults on hosts with RCH Downstream Port topologies.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to surface the out-of-bounds reads during CXL AER event replay.
Audit installed kernel builds against the fixed commits 29458e6, 8bd3523, and 8e3d9db to identify unpatched hosts.
Correlate kernel crash telemetry with CXL RAS subsystem stack frames across the fleet.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on cxl or aer error patterns.
Track kernel panics and soft lockups on servers using CXL memory or accelerators.
Monitor package inventories for kernel versions predating the upstream fix.

How to Mitigate CVE-2026-89731

Immediate Actions Required

Apply the upstream kernel fixes referenced by commits 29458e6, 8bd3523, and 8e3d9db as soon as your distribution ships them.
Prioritize patching hosts that expose CXL Root Complex Hierarchies with Downstream Port AER capabilities.
Restrict local shell access on affected systems until patched kernels are deployed.

Patch Information

The fix bounds the MMIO read to the physical AER registers (through the 16-byte Header Log) and zero-initializes the destination buffer so software-only fields such as header_len are deterministic. Rebuild or install a kernel that includes any of the following upstream commits: Kernel Git Commit 29458e6, Kernel Git Commit 8bd3523, and Kernel Git Commit 8e3d9db. Rebooting into the patched kernel is required for the change to take effect.

Workarounds

Disable the CXL RAS module or unload cxl_core on systems that do not require CXL error reporting.
Limit local user access and enforce least privilege on hosts with CXL hardware until patched kernels are installed.
Where feasible, run non-critical workloads on kernels not built with CONFIG_CXL_BUS until remediation is complete.

bash

# Verify the running kernel version and check for the fix
uname -r
grep -R "cxl_rch_get_aer_info" /usr/src/linux-$(uname -r)/drivers/cxl/ 2>/dev/null

# Optionally prevent the CXL core module from loading on non-CXL workloads
echo "blacklist cxl_core" | sudo tee /etc/modprobe.d/blacklist-cxl.conf
sudo update-initramfs -u