CVE-2026-23327 Linux CVE debrief

Who should care

Linux kernel maintainers, system administrators running CXL-enabled hardware, cloud providers offering bare-metal instances with CXL memory expansion, and security teams monitoring for local kernel information disclosure vulnerabilities.

Technical summary

The CXL (Compute Express Link) driver subsystem in the Linux kernel fails to validate user-supplied mailbox payload sizes before casting and dereferencing payload contents in `cxl_payload_from_user_allowed()`. A raw mailbox command with an undersized payload causes `uuid_equal()` to read past buffer boundaries, resulting in a slab-out-of-bounds read detectable by KASAN. The vulnerability is exposed through the `cxl_memdev_ioctl` path and affects local attackers with access to CXL memory device interfaces. The resolution introduces explicit `in_size` parameter validation to ensure payload buffers meet minimum size requirements before structure access.

Defensive priority

high

Recommended defensive actions

• Apply the upstream kernel patches that add `in_size` validation to `cxl_payload_from_user_allowed()` for all affected kernel versions (5.19.x through 6.19.6, and 7.0-rc series).
• If patching is not immediately feasible, restrict access to CXL memory device nodes (`/dev/cxl/*`) to trusted administrative users only, as the attack vector requires local access and privileges to open these device file
• Monitor kernel logs for KASAN slab-out-of-bounds reports originating from `drivers/cxl/core/mbox.c` as potential exploitation indicators
• Upgrade to Linux kernel 6.19.7 or later, or apply the stable backports referenced in the patch commits, once available from distribution vendors
• Review custom or third-party CXL management tools that issue raw mailbox commands to ensure they validate payload sizes before kernel submission

Evidence notes

The vulnerability description and KASAN stack trace are sourced directly from the CVE record. The affected function `cxl_payload_from_user_allowed()` and file `drivers/cxl/core/mbox.c` are explicitly named in the trace. The fix description—adding `in_size` parameter and validating payload size—is stated in the resolution text. CPE criteria indicate affected Linux kernel versions from 5.19.1 through 6.19.6, plus 5.19 initial release and 7.0-rc1 through 7.0-rc7. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H yields the provided score of 7.1 (HIGH).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.