GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89731 (GCVE-0-2026-89731)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aer_capability_regs). This struct is a software layout and its embedded struct pcie_tlp_log is larger than the on-wire AER capability. As a result the loop reads past the mapped AER register block. The over-read also populates the software-only tail fields including header_log.header_len. An out-of-range header_len passed to pcie_print_tlp_log() can then loop past the header log buffer and cause a second out-of-bounds read. The read was correct when introduced, but struct pcie_tlp_log has since grown (Header Log and TLP Prefix Log sizes, header_len and flit fields), so sizeof(struct aer_capability_regs) no longer matches the physical AER capability. Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab , < 8bd3523df1319edc61cd391e695c84a4618516df (git)
Affected: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab , < 8e3d9dbb25d3ddbe72b4542ec4f7c4e622fe0ced (git)
Affected: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab , < 29458e62d0829cbc99435f3e44fd560f9bbf1da7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/ras_rch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8bd3523df1319edc61cd391e695c84a4618516df",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            },
            {
              "lessThan": "8e3d9dbb25d3ddbe72b4542ec4f7c4e622fe0ced",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            },
            {
              "lessThan": "29458e62d0829cbc99435f3e44fd560f9bbf1da7",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/ras_rch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read\n\ncxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from\nthe RCRB MMIO block using a readl() loop bounded by sizeof(struct\naer_capability_regs). This struct is a software layout and its embedded\nstruct pcie_tlp_log is larger than the on-wire AER capability. As a\nresult the loop reads past the mapped AER register block.\n\nThe over-read also populates the software-only tail fields including\nheader_log.header_len. An out-of-range header_len passed to\npcie_print_tlp_log() can then loop past the header log buffer and cause\na second out-of-bounds read.\n\nThe read was correct when introduced, but struct pcie_tlp_log has since\ngrown (Header Log and TLP Prefix Log sizes, header_len and flit fields),\nso sizeof(struct aer_capability_regs) no longer matches the physical AER\ncapability.\n\nBound the read to the physical AER registers, header through the 16 byte\nHeader Log. Zero the destination first so the software-only fields are\ndeterministic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable cxl_rch_get_aer_info() runs only from the host PCI AER IRQ path (aer_isr \u2192 cxl_rch_handle_error \u2192 cxl_error_detected/cxl_cor_error_detected) on Restricted CXL Host/Device topologies; it is not reachable from network protocols. Local access to a CXL host is the applicable vector and is higher severity than physical card insertion.\nAC:L - Once an RCH downstream-port AER event is raised, the readl() loop copies sizeof(struct aer_capability_regs) (100 bytes) instead of the 44-byte physical Header Log with no race. Unimplemented RCRB MMIO commonly returns 0xFFFFFFFF, so header_len/flit reliably drive a second out-of-bounds read in pcie_print_tlp_log().\nPR:L - The AER ISR and CXL error handlers perform no capability check. An unprivileged local user, or a guest with a passed-through CXL endpoint, can induce CXL protocol/AER errors that reach this path; init-namespace root is not required.\nUI:N - PCIe AER interrupts are dispatched automatically by aer_isr() into the CXL PCI error handlers; no victim mount, file open, or other interactive action is required.\nS:U - The MMIO and stack out-of-bounds reads occur in the host kernel CXL/PCI AER code and do not cross a VM, IOMMU, or sandbox security boundary.\nC:H - Adjacent RCRB MMIO is copied into software-only fields including header_log.header_len; pcie_print_tlp_log() then reads log-\u003edw[] with a u8 index up to 255 past the 14-dword array, leaking up to ~1KB of kernel stack and RCRB contents to dmesg.\nI:N - Both issues are out-of-bounds reads only: MMIO is copied into a correctly sized stack aer_capability_regs, and pcie_print_tlp_log() only reads log-\u003edw[]. In-bounds status writel()s and length-capped scnprintf() provide no write or control-flow primitive.\nA:H - The unbounded stack read in pcie_print_tlp_log() and readl() past the physical AER capability in the RCRB can fault or raise a platform machine-check, producing a kernel oops/panic; uncorrectable CXL RAS handling can also disable CXL.mem."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:45.296Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8bd3523df1319edc61cd391e695c84a4618516df"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e3d9dbb25d3ddbe72b4542ec4f7c4e622fe0ced"
        },
        {
          "url": "https://git.kernel.org/stable/c/29458e62d0829cbc99435f3e44fd560f9bbf1da7"
        }
      ],
      "title": "cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89731",
    "datePublished": "2026-09-11T19:46:41.312Z",
    "dateReserved": "2026-09-11T19:38:34.760Z",
    "dateUpdated": "2026-09-13T06:33:45.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89731",
      "date": "2026-09-17",
      "epss": "0.00158",
      "percentile": "0.05327"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89731\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:03.487\",\"lastModified\":\"2026-09-13T07:17:38.140\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read\\n\\ncxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from\\nthe RCRB MMIO block using a readl() loop bounded by sizeof(struct\\naer_capability_regs). This struct is a software layout and its embedded\\nstruct pcie_tlp_log is larger than the on-wire AER capability. As a\\nresult the loop reads past the mapped AER register block.\\n\\nThe over-read also populates the software-only tail fields including\\nheader_log.header_len. An out-of-range header_len passed to\\npcie_print_tlp_log() can then loop past the header log buffer and cause\\na second out-of-bounds read.\\n\\nThe read was correct when introduced, but struct pcie_tlp_log has since\\ngrown (Header Log and TLP Prefix Log sizes, header_len and flit fields),\\nso sizeof(struct aer_capability_regs) no longer matches the physical AER\\ncapability.\\n\\nBound the read to the physical AER registers, header through the 16 byte\\nHeader Log. Zero the destination first so the software-only fields are\\ndeterministic.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/cxl/core/ras_rch.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab\",\"lessThan\":\"8bd3523df1319edc61cd391e695c84a4618516df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab\",\"lessThan\":\"8e3d9dbb25d3ddbe72b4542ec4f7c4e622fe0ced\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab\",\"lessThan\":\"29458e62d0829cbc99435f3e44fd560f9bbf1da7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/cxl/core/ras_rch.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29458e62d0829cbc99435f3e44fd560f9bbf1da7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8bd3523df1319edc61cd391e695c84a4618516df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e3d9dbb25d3ddbe72b4542ec4f7c4e622fe0ced\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:47:37+00:00",
      "cve": "CVE-2026-89731",
      "id": "CVE-2026-89731",
      "initial_release_date": "2026-09-11T19:46:41.312000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Out-of-bounds read in CXL/RAS AER handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89731.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:56:37Z",
      "cve": "CVE-2026-89731",
      "id": "CVE-2026-89731",
      "initial_release_date": "2026-09-12T16:22:40Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89731",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89731.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.