CVE-2026-89571Medium· 5.5▾ SunlitA flaw was found in the Linux kernel's CXL (Compute Express Link) features. A local attacker could exploit an out-of-bounds read vulnerability in the `fwctl_cmd_rpc()` and `cxlctl_set_feature()` functions. This occurs when the system attem…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
— → 4.4
— → 4.4
none → medium
— → 7.1
none → high
7.1 → 4.4
high → medium
4.4 → 7.1
medium → high
7.1 → 4.4
high → medium
Last analysed / modified upstream
4.4 → 5.5
A flaw was found in the Linux kernel's CXL (Compute Express Link) features. A local attacker could exploit an out-of-bounds read vulnerability in the fwctl_cmd_rpc() and cxlctl_set_feature() functions. This occurs when the system attempts to copy data with a small input buffer length but processes a larger, user-controlled operation size without proper validation. This can lead to reading beyond the allocated memory, causing a kernel crash and resulting in a denial of service.
kernel: cxl/features: bound fwctl command payload to the input buffer — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-18.
Not affected:
Refer to the advisory for fix availability.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80958Medium· 5.5kernel: dm-pcache: clamp the tail kset read to the segment data region (CVE-2026-80958)
CVE-2026-80959Medium· 5.5kernel: dm-pcache: bound the persisted tail-position offset (CVE-2026-80959)
CVE-2026-89614Medium· 5.5kernel: ntfs: bound the free-cluster bitmap scan to the volume (CVE-2026-89614)
CVE-2026-80962Medium· 5.5kernel: dm-pcache: validate geometry fields from on-disk cache_info (CVE-2026-80962)
CVE-2026-89743Medium· 5.5kernel: misc: nsm: bound the device-reported response length (CVE-2026-89743)
CVE-2026-89621Medium· 5.5kernel: HID: mcp2221: validate report size in mcp2221_raw_event() (CVE-2026-89621)