In the Linux kernel the CXL firmware controller driver contained a code path in cxlctl_get_supported_features() that could overflow the entries array when the num_entries variable was not initialized. The oversight would allow a 48‑byte write to a zero‑length buffer, exposing kernel memory to arbitrary writes. The patch initializes num_entries earlier and silences the fortify warning, thereby eliminating the memory corruption risk. Historically, the flaw could have been leveraged by a local attacker with sufficient permissions to invoke the driver and achieve privilege escalation through kernel memory manipulation.

Linux kernel, all releases prior to the commit that introduces the fix. Distribution kernel packages built before the patch include the vulnerable code; kernels released after the commit contain the corrected implementation in the cxl/fwctl driver.

The vulnerability is a classic buffer overflow (CWE‑119). No CVSS score is provided, but the exploit would require local access to the CXL firmware controller and could lead to full kernel compromise. With EPSS not available, the likelihood of exploitation is uncertain, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploitation at the time of analysis. When present, the flaw remains exploitable through local privilege escalation; attackers would need the ability to execute code that interacts with the cxlctl interface.