« Volver al listado

CVE-2026-93077

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

cxl/features: Clamp Get Feature output size to the remaining buffer

cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out.

Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93077",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5e5ac21f629de796ab5d598b59c5e468c6fe4f95",
              "lessThan": "b8abbd5c2928fd839dab702244cc57b228ab43aa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5e5ac21f629de796ab5d598b59c5e468c6fe4f95",
              "lessThan": "ca95b15a0760e7724e61addbdd61050be13b6406",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5e5ac21f629de796ab5d598b59c5e468c6fe4f95",
              "lessThan": "2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/cxl/core/features.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/cxl/core/features.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:18:01.643",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8abbd5c2928fd839dab702244cc57b228ab43aa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ca95b15a0760e7724e61addbdd61050be13b6406",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Clamp Get Feature output size to the remaining buffer\n\ncxl_get_feature() reads a feature in a loop but passes a fixed size_out\nas the output capacity every iteration. On the last partial iteration\nthe buffer has less room left, so a device that returns more than asked\ncan overflow feat_out.\n\nUse the per-iter size data_to_rd_size, which already tracks the\nremaining room, as the output capacity."
    }
  ],
  "lastModified": "2026-09-17T17:18:01.643",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}