CVE-2026-93079

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-93079

Key Details

CVE	CVE-2026-93079
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

cxl/features: Reject Get Feature count larger than the output buffer

cxlctl_get_feature() sizes its output buffer from the user's

fwctl_rpc.out_len, but the device is told to write

cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a

separate user-controlled value. Nothing bounds count against out_len, so

a small out_len with a large count overflows the kvzalloc()'d buffer.

A heap OOB write reachable from FWCTL_RPC.

Reject requests where count exceeds the available payload room, before

allocating. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-93079
CVE	https://www.cve.org/CVERecord?id=CVE-2026-93079

Source

Reference

NVD

CVE