Linux Kernel EUVD-2026-82189

Requires local access to the FWCTL_RPC (fwctl) userspace interface, i.e. an open handle to a /dev/fwctl character device backed by a CXL device that exposes the Features/Get Feature mailbox command. The attacker must be able to issue an FWCTL_RPC with independently controlled fwctl_rpc.out_len and cxl_mbox_get_feat_in.count values, setting out_len small and count large so the device writes more bytes than the kvzalloc() buffer holds. Limiting factors: not remotely reachable (AV:L), requires the CXL Features subsystem to be present and the device driver bound (kernel 6.15+), and requires whatever permissions gate the fwctl device node (PR:L) - this is not exploitable against a default machine lacking CXL feature-capable hardware.

This is one of the more genuinely serious of the recent Linux fwctl-family issues because it is a real attacker-controlled heap out-of-bounds WRITE, not merely a probe/error-path crash. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 7.8) is internally consistent with the description: local access to the FWCTL_RPC ioctl (PR:L), low complexity because the attacker directly controls both fwctl_rpc.out_len and cxl_mbox_get_feat_in.count, and no user interaction. The kill signals are, however, muted by exposure: FWCTL_RPC requires access to a /dev/fwctl character device and a CXL device that exposes the Features mailbox, which is a narrow and privileged surface rather than a remote/default one. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent exploitation - the case for prioritization rests on the strength of the primitive (a size-controlled heap overwrite reachable from userspace), not on observed activity. The vendor's C:H/I:H/A:H is defensible for a controlled heap corruption primitive but is slightly optimistic on confidentiality (this is a write, not a read/leak); I weight it toward I:H/A:H with C:L. Net: a real but access-gated privilege-escalation/DoS candidate worth patching promptly on CXL-equipped hosts, not an internet-facing emergency.

A local user (or a compromised low-privilege process) with access to the /dev/fwctl interface on a host with a CXL device supporting the Features mailbox issues an FWCTL_RPC Get Feature call, supplying a small out_len but a large count. The kernel sizes the kvzalloc() buffer from out_len yet instructs the device to write count bytes into rpc_out->payload, overflowing the heap allocation with device-returned data, enabling kernel memory corruption that can lead to denial of service or privilege escalation. No public exploit code is identified at time of analysis.