{"id":"CVE-2026-93079","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Reject Get Feature count larger than the output buffer\n\ncxlctl_get_feature() sizes its output buffer from the user's\nfwctl_rpc.out_len, but the device is …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Reject Get Feature count larger than the output buffer\n\ncxlctl_get_feature() sizes its output buffer from the user's\nfwctl_rpc.out_len, but the device is …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 5908f3ed6dc209e5c824e63afda7545805f75a7e < 3f02031a0a53de0d3ef066c92d0486b2b11be40c","Linux >= 5908f3ed6dc209e5c824e63afda7545805f75a7e < 329ea475581c647a680a6937e353c1a6e2534b40","Linux >= 5908f3ed6dc209e5c824e63afda7545805f75a7e < 4bf6bac375076ced2fa4b3fef8739bd985f93456","Linux 6.15"],"published":"2026-09-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:18:20.330","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93079","references":[{"url":"https://git.kernel.org/stable/c/329ea475581c647a680a6937e353c1a6e2534b40","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f02031a0a53de0d3ef066c92d0486b2b11be40c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4bf6bac375076ced2fa4b3fef8739bd985f93456","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00161,"epssPercentile":0.0576,"ingestedAt":"2026-09-17T16:21:47.762Z","slug":"CVE-2026-93079","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Reject Get Feature count larger than the output buffer\n\ncxlctl_get_feature() sizes its output buffer from the user's\nfwctl_rpc.out_len, but the device is told to write\ncxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a\nseparate user-controlled value. Nothing bounds count against out_len, so\na small out_len with a large count overflows the kvzalloc()'d buffer.\nA heap OOB write reachable from FWCTL_RPC.\n\nReject requests where count exceeds the available payload room, before\nallocating.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":207367,"id":"CVE-2026-93079","ts":1789757341411,"field":"cvss","old":null,"new":"7.8"},{"seq":207366,"id":"CVE-2026-93079","ts":1789757341411,"field":"severity","old":"none","new":"high"}]}