CVE-2026-23327

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()

cxl_payload_from_user_allowed() casts and dereferences the input

payload without first verifying its size. When a raw mailbox command

is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG,

which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer,

triggering a KASAN splat:

BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683

Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258

CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:94 [inline]

dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120

print_address_description mm/kasan/report.c:378 [inline]

print_report+0xce/0x650

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References