CVE-2026-23327

An out-of-bounds read vulnerability was found in the Linux kernel's CXL (Compute Express Link) mailbox driver. The cxl_payload_from_user_allowed() function casts and dereferences the input payload without first validating its size. When a raw mailbox command is sent with an undersized payload, uuid_equal() reads past the allocated buffer, causing an out-of-bounds memory access.

This flaw affects systems with CXL memory devices. The OOB read occurs when userspace sends a mailbox command with an undersized payload via ioctl. The missing size validation allows reading past buffer boundaries. Exploitation requires access to the CXL device node, typically requiring root or appropriate device permissions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.