https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:24:39 +0000 https://db.gcve.eu/vuln/cve-2026-93078 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>cxl/features: Reject Set Features output buffer smaller than the header</p> <p>cxlctl_set_feature() sizes its output buffer from the user&#39;s fwctl_rpc.out_len but never checks it is large enough to hold even the fwctl_rpc_cxl_out header. With out_len == 0 , kvzalloc() returns ZERO_SIZE_PTR, which passes the !rpc_out check, the subsequent rpc_out-&gt;size = 0 then writes through the poison pointer.</p> <p>Reject requests whose output buffer can&#39;t hold the response header, before allocating. The Set Feature reply carries no payload, so the header is all that is required.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>cxl/features: Reject Set Features output buffer smaller than the header</p> <p>cxlctl_set_feature() sizes its output buffer from the user&#39;s fwctl_rpc.out_len but never checks it is large enough to hold even the fwctl_rpc_cxl_out header. With out_len == 0 , kvzalloc() returns ZERO_SIZE_PTR, which passes the !rpc_out check, the subsequent rpc_out-&gt;size = 0 then writes through the poison pointer.</p> <p>Reject requests whose output buffer can&#39;t hold the response header, before allocating. The Set Feature reply carries no payload, so the header is all that is required.</p> https://db.gcve.eu/vuln/cve-2026-93078