CVE-2026-93078

A flaw was found in the Linux kernel's CXL (Compute Express Link) feature handling. The cxlctl_set_feature() function, responsible for setting CXL features, does not properly validate the size of the output buffer provided by a user. If a local attacker provides an output buffer of zero length, it can lead to a write to an invalid memory address, commonly referred to as a 'poison pointer'. This vulnerability could allow the attacker to cause a system crash, resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.