VYPR
← All advisories
High severity7.1NVD Advisory· Published Mar 25, 2026· Updated Apr 23, 2026

CVE-2026-23327

CVE-2026-23327

Description

In the Linux kernel, the following vulnerability has been resolved:

cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()

cxl_payload_from_user_allowed() casts and dereferences the input payload without first verifying its size. When a raw mailbox command is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG, which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer, triggering a KASAN splat:

BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683 Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258

CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace:

__dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xce/0x650 mm/kasan/report.c:482 kasan_report+0xce/0x100 mm/kasan/report.c:595 memcmp+0x176/0x1d0 lib/string.c:683 uuid_equal include/linux/uuid.h:73 [inline] cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline] cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline] cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline] cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643 __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline] cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdaf331ba79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79 RDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003 RBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768

Add 'in_size' parameter to cxl_payload_from_user_allowed() and validate the payload is large enough.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing size check in Linux kernel's CXL mailbox driver lets local attackers read out-of-bounds memory via an undersized payload, leading to an OOB read.

Root

Cause

In the Linux kernel's CXL (Compute Express Link) mailbox handling code, the function cxl_payload_from_user_allowed() casts and dereferences the input payload buffer without first verifying that it is large enough. When a raw mailbox command is submitted with a payload smaller than the expected size (for example, sending only 1 byte for CXL_MBOX_OP_CLEAR_LOG, which requires a 16-byte UUID), the subsequent call to uuid_equal() (which uses memcmp) reads memory beyond the allocated buffer, triggering an out-of-bounds access. This flaw exists in the cxl_validate_cmd_from_user() path that processes user-supplied mailbox commands [1].

Attack

Vector

An attacker with local access to the system and the ability to send CXL_MEMDEV_IOCTL ioctls to a CXL memory device device file can exploit this vulnerability. No special privileges beyond CAP_SYS_RAWIO or equivalent access to the /dev/cxl/mem* device are required. By crafting a raw mailbox command with an undersized payload, the attacker can force a kernel memory read that extends past the allocated slab buffer. The KASAN report confirms the out-of-bounds read occurs during the memcmp operation inside uuid_equal() [1].

Impact

The primary consequence is a slab-out-of-bounds read that leaks kernel memory contents to the attacker. Repeated exploitation could allow an unprivileged local user to disclose sensitive information from adjacent kernel objects. Since the read is of a fixed 8-byte size (the UUID comparison), the leak is limited but still represents an information disclosure vulnerability. The CVSS v3 score of 7.1 (High) reflects the potential for confidentiality impact.

Mitigation

This bug is fixed in the Linux kernel by commit 60b5d1f68338 (stable tree). The fix adds a proper size check in cxl_payload_from_user_allowed() before accessing the payload buffer. Users should apply the kernel update to any systems using CXL hardware. No workaround exists without patching the kernel.

References
  1. Making sure you're not a bot!

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

10
  • Linux/Kernel10 versions
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 9 more
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=5.19.1,<6.19.7
    • cpe:2.3:o:linux:linux_kernel:5.19:-:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
    • (no CPE)

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.