In the Linux kernel's CXL mailbox implementation, the function cxl_payload_from_user_allowed() casts and dereferences an input payload without first ensuring that the payload buffer is large enough. When a raw mailbox command containing an undersized payload is processed—for example, sending a 1-byte payload for the CXL_MBOX_OP_CLEAR_LOG operation that expects a 16-byte UUID—the kernel reads past the end of the buffer. This out-of-bounds read is caught by Kernel Address Sanitizer, producing a KASAN splat that indicates a memory corruption condition. The corruption can potentially allow an attacker to read kernel memory, leading to information disclosure or, if further exploitation is achieved, local privilege escalation or a system crash.

The vulnerability affects the Linux kernel, specifically the CXL core mailbox code in drivers/cxl/core/mbox.c. All kernels that include this code and have not applied the recent patch introducing an in_size parameter are potentially affected. The patch addresses the issue in the referenced kernel commits, and the vulnerability was demonstrated against a 6.19.0 kernel in a QEMU test environment. Administrators should verify whether their running kernel contains the fix; any kernel prior to the patch is considered susceptible.

With a CVSS score of 7.0 this vulnerability is considered high severity. The EPSS score is below 1%, indicating low predicted exploitation frequency, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers likely need access to a CXL device or the ability to invoke ioctl calls on /dev/cxl devices, implying local or privileged access. While the vulnerability can cause a denial of service through a kernel crash, a malicious actor with sufficient privileges could leverage the out-of-bounds read to leak kernel data or potentially bootstrap further privilege‑escalation exploits. System availability and kernel integrity are at risk.