CVE-2026-23327: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23327 is a buffer over-read (out-of-bounds read) vulnerability in the Linux kernel's CXL (Compute Express Link) mailbox handler, specifically in the cxl_payload_from_user_allowed() function within drivers/cxl/core/mbox.c. The function casts and dereferences user-supplied input payloads without first validating their size, allowing a local attacker to trigger an out-of-bounds memory read by sending a raw mailbox command with an undersized payload. Affected versions include Linux kernel 5.19 through 6.19.6 and 7.0-rc1 through 7.0-rc7. The vulnerability was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read). The cxl_payload_from_user_allowed() function accepts a raw mailbox command payload from userspace via ioctl and immediately casts it to a structured type without verifying that the payload meets the minimum required size. For example, when CXL_MBOX_OP_CLEAR_LOG is issued with a 1-byte payload instead of the expected 16-byte UUID, the subsequent call to uuid_equal() invokes memcmp() which reads 8 bytes past the end of the allocated buffer, triggering a KASAN slab-out-of-bounds splat. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it accessible to any local user with ioctl access to a CXL memory device (/dev/cxl/memdevX). The fix adds an in_size parameter to cxl_payload_from_user_allowed() to validate payload size before dereferencing (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation can result in information disclosure by reading sensitive kernel memory beyond the intended buffer boundary, as well as denial of service through kernel crashes triggered by KASAN detection of the out-of-bounds read. The vulnerability does not affect integrity (no write primitive). While exploitation requires local access, any unprivileged user with access to a CXL memory device ioctl interface can trigger the condition, potentially exposing sensitive kernel data or destabilizing the system (Red Hat Advisory, Red Hat Bugzilla).

1. Identify target: Confirm the target system runs a vulnerable Linux kernel version (5.19 through 6.19.6, or 7.0-rc1 through 7.0-rc7) with CXL memory hardware present and accessible device nodes (e.g., /dev/cxl/mem0).
2. Gain local access: Obtain a local user account on the target system with read/write access to the CXL memory device node.
3. Craft undersized ioctl payload: Construct a raw CXL mailbox command (e.g., CXL_MBOX_OP_CLEAR_LOG) with a payload smaller than the expected minimum (e.g., 1 byte instead of the required 16-byte UUID).
4. Issue ioctl: Send the crafted command to the CXL device via the ioctl() syscall targeting the cxl_memdev_ioctl handler (ioctl code 0xc030ce02 as seen in the KASAN trace).
5. Trigger out-of-bounds read: The kernel's cxl_payload_from_user_allowed() dereferences the undersized buffer, causing uuid_equal()/memcmp() to read beyond the allocated slab, potentially leaking adjacent kernel memory contents or triggering a KASAN crash (Red Hat Bugzilla).

• Logs: Kernel log (dmesg) entries containing BUG: KASAN: slab-out-of-bounds in memcmp referencing drivers/cxl/core/mbox.c; stack traces involving cxl_payload_from_user_allowed, cxl_mbox_cmd_ctor, cxl_validate_cmd_from_user, or cxl_send_cmd.
• Process: Unusual processes (e.g., fuzzing tools like syz) issuing ioctl calls to /dev/cxl/mem* devices with anomalous payload sizes; unexpected low-privilege processes accessing CXL device nodes.
• Network: No network-based indicators expected, as this is a local exploitation vector.
• System: Repeated kernel panics or system instability on hosts with CXL hardware; KASAN reports in kernel logs referencing lib/string.c:683 (memcmp) (Red Hat Bugzilla).

The vulnerability is patched in Linux kernel version 6.19.7 and later stable releases. Upstream kernel commits 60b5d1f68338aff2c5af0113f04aefa7169c50c2 and 7c8a7b7f063b7e7ae9bba4cbaa14a5d2fe3a55e1 address the issue by adding payload size validation to cxl_payload_from_user_allowed(). For systems that cannot be immediately patched, administrators should restrict access to CXL memory device nodes (/dev/cxl/memdevX) to trusted users only using file permissions or udev rules, and disable raw CXL mailbox ioctl access if CXL functionality is not required (Red Hat Advisory, Kernel Patch 1, Kernel Patch 2).