Linux kernel CXL mailbox: undersized raw command payload read out of bounds

Impact

A local user with access to a CXL memdev character device can issue a raw mailbox command with an undersized payload - one byte where a 16-byte UUID is expected - and the kernel casts and dereferences it without checking the size, reading past the allocated buffer. The practical result is a slab out-of-bounds read, i.e. kernel memory disclosure or a crash of the node. This matters on CXL-attached memory hosts, which are appearing in accelerator and memory-tiering tiers of GPU fleets; raw mailbox access is normally root-only and gated on CONFIG_CXL_MEM_RAW_COMMANDS, so on a standard hardened host this is not reachable by an ordinary tenant.

Who can reach it

Local user holding a CXL memdev device node (/dev/cxl/memN) with raw mailbox commands enabled in the kernel build. Requires local privileges; not reachable from the network or from a container without that device.

What to do

Pick up the stable kernel fix that adds the in_size parameter and validates the payload length, then reboot each affected node. Interim mitigation: build without CONFIG_CXL_MEM_RAW_COMMANDS or restrict access to the CXL memdev nodes. Hosts without CXL memory devices need no action.

References

Related entries

• Linux kernel (drivers/pci/controller/dwc): Raising an MSI-X interrupt is a posted PCI write, and the endpoint driverCVE-2026-23361 · Linux kernel (drivers/pci/controller/dwc)High
• Linux nvme-pci: slab out-of-bounds read in nvme_dbbuf_set during controller resetCVE-2026-43449 · Linux kernel nvme-pci driver (nvme_dbbuf_set doorbell buffer loop)High
• Linux EFI: unaccepted-memory table under-reserved, panicking large Intel TDX guestsCVE-2026-45851 · Linux kernel EFI unaccepted-memory table reservation (reserve_unaccepted)High
• Linux kernel crypto authencesn: out-of-bounds access with a 1-3 byte ahash digest via AF_ALGCVE-2026-46033 · Linux kernel crypto authencesn (ahash digest size validation)High
• Linux kernel (drivers/iommu/intel): Killing a VM that has a device attached through the VT-d nested/PASID path makesCVE-2026-52953 · Linux kernel (drivers/iommu/intel)High
• Linux kernel BPF: out-of-bounds read copying unaligned cgroup-storage values into a per-CPU mapCVE-2026-53076 · Linux kernel BPF (pcpu_init_value, per-CPU map element copy)High