CVE-2026-23327

Aliases:UBUNTU-CVE-2026-23327DEBIAN-CVE-2026-23327CGA-276j-xj43-px7mCGA-6qjg-gr96-9w3cCGA-6wmm-34rx-j7hrCGA-752r-m76c-mm3cCGA-7x5r-3mf4-vj7wCGA-f729-h9mc-27h7CGA-f95h-vcm9-xx3vCGA-fr49-mpq6-xhxmCGA-gfmh-qpc8-9hj2CGA-h539-4qr7-32cvCGA-qhg4-mr76-hjxpCGA-rf67-q7xw-4wq3CGA-rwhm-6f52-ghc6CGA-v5gf-cpq2-qwphCGA-v6cf-w6jf-r6fmCGA-wxh9-j4jc-3438CGA-x6h4-r5v4-42jpCGA-8j58-pj3j-fx7vCGA-mq2j-8g9w-r22fCGA-28xm-6g8x-v7xhCGA-3cw2-58j4-6c5xCGA-3r4q-m2g8-9hj4CGA-4252-wrxh-x2xrCGA-54vq-r5qc-7f76CGA-5gfm-5mr5-pmx6CGA-9844-wpc6-h48qCGA-hq8c-mcf2-hxw2CGA-m67h-q983-5hvfCGA-qwqh-96wg-m69rCGA-w3c7-v76r-4rmmCGA-m6cm-rm93-2jr4
Advisory lineage Upstream: 0 Downstream: 14
Modified
Published: 25 Mar 2026, 10:27
Last modified:01 Jun 2026, 16:10

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7.1 HIGH
v3.1 (nvd)
EPSS Score
0.12% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Mar 2026, 10:27
Published
Vulnerability first disclosed
01 Jun 2026, 16:10
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() cxl_payload_from_user_allowed() casts and dereferences the input payload without first verifying its size. When a raw mailbox command is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG, which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer, triggering a KASAN splat: BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683 Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258 CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xce/0x650 mm/kasan/report.c:482 kasan_report+0xce/0x100 mm/kasan/report.c:595 memcmp+0x176/0x1d0 lib/string.c:683 uuid_equal include/linux/uuid.h:73 [inline] cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline] cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline] cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline] cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643 __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline] cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdaf331ba79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79 RDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003 RBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768 </TASK> Add 'in_size' parameter to cxl_payload_from_user_allowed() and validate the payload is large enough.

CVSS Metrics

  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS Trends

Current EPSS score: 0.12%• Percentile: 2%

Techniques & Countermeasures

  • CWE-125•Out-of-bounds Read

    The product reads data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • chainguard•linux-aws-6.12

    < 0

  • chainguard•linux-aws-6.18

    < 0

  • chainguard•linux-azure-6.12

    < 0

  • chainguard•linux-azure-6.18

    < 0

  • chainguard•linux-desktop-6.18

    all

  • chainguard•linux-desktop-6.18-bootc

    all

  • chainguard•linux-desktop-6.18-bootc-boot-installed

    all

  • chainguard•linux-desktop-6.18-headers

    all

  • chainguard•linux-desktop-6.18-modules

    all

  • chainguard•linux-firecracker-6.18

    all

  • chainguard•linux-gcp-6.12

    < 0

  • chainguard•linux-gcp-6.18

    < 0 | < 6.18.38-r2

  • chainguard•linux-gcp-6.18-bootc

    < 6.18.38-r2

  • chainguard•linux-gcp-6.18-bootc-boot-installed

    < 0

  • chainguard•linux-qemu-6.12

    < 0

  • chainguard•linux-qemu-6.18

    < 6.18.38-r2 | < 0

  • chainguard•linux-qemu-6.18-bootc

    < 6.18.38-r2

  • chainguard•linux-qemu-6.18-bootc-boot-installed

    < 0

  • chainguard•linux-qemu-melange

    < 0

  • chainguard•linux-vmware-6.12

    < 0

  • chainguard•linux-vmware-6.18

    < 0

  • debian•linux

    all | all | < 6.19.8-1

  • ubuntu•linux

    all | all

  • ubuntu•linux-allwinner-5.19

    all

  • ubuntu•linux-aws

    all | all

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

  • ubuntu•linux-aws-5.13

    all

  • ubuntu•linux-aws-5.19

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.8

    all

  • ubuntu•linux-aws-6.14

    all

  • ubuntu•linux-aws-6.17

    all

  • ubuntu•linux-aws-6.2

    all

  • ubuntu•linux-aws-6.5

    all

  • ubuntu•linux-aws-6.8

    all

  • ubuntu•linux-aws-fips

    all

  • ubuntu•linux-azure

    all | all | all

  • ubuntu•linux-azure-5.11

    all

  • ubuntu•linux-azure-5.13

    all

  • ubuntu•linux-azure-5.19

    all

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.8

    all

  • ubuntu•linux-azure-6.11

    all

  • ubuntu•linux-azure-6.14

    all

  • ubuntu•linux-azure-6.17

    all

  • ubuntu•linux-azure-6.2

    all

  • ubuntu•linux-azure-6.5

    all

  • ubuntu•linux-azure-6.8

    all

  • ubuntu•linux-azure-edge

    all

Showing first 50 affected entries in server-rendered view.

References (8)