A heap out-of-bounds write vulnerability in the Linux kernel CXL subsystem could allow a local authenticated attacker to achieve code execution or system instability.

The vulnerability exists in the cxlctl_get_feature function, which fails to properly validate the user-provided count against the allocated output buffer size. A local user with low privileges can trigger a heap out-of-bounds write by specifying a count that exceeds the buffer limit, leading to potential memory corruption.

The flaw carries a CVSS score of 7.8, indicating a high severity level. Successful exploitation by a local attacker could lead to a complete system compromise, including unauthorized data access, privilege escalation, or a denial of service through system crashes. Because this affects the core kernel, it poses a significant risk to the integrity and availability of the host operating system.

Immediate Action: Update the Linux kernel to version 6.18.52, 7.2.6, or a later stable release where this issue has been patched.

Proactive Monitoring: Monitor system logs for unusual kernel panic events or repeated failures in CXL device communication that may indicate exploitation attempts.

Compensating Controls: Restrict access to CXL device interfaces and the FWCTL_RPC subsystem to only authorized users and processes to minimize the attack surface.

Public Exploit Available: No

Given the high CVSS severity and the potential for kernel-level compromise, organizations should prioritize patching the Linux kernel across all affected environments. Administrators should verify the current kernel version and apply the recommended updates as part of the next scheduled maintenance window to effectively mitigate the risk of local exploitation.