# CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() CVE-2026-23327 is fixed in 16 products on 1 platform, first by DEBIAN-CVE-2026-23327, released March 25, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-23327 - Priority: High - CVSS: 7.1 (Important) - EPSS: 0.0017 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 25, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23327 ## Description In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() cxl_payload_from_user_allowed() casts and dereferences the input payload without first verifying its size. When a raw mailbox command is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG, which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer, triggering a KASAN splat: BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683 Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258 CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xce/0x650 mm/kasan/report.c:482 kasan_report+0xce/0x100 mm/kasan/report.c:595 memcmp+0x176/0x1d0 lib/string.c:683 uuid_equal include/linux/uuid.h:73 [inline] cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline] cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline] cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline] cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643 __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline] cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdaf331ba79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79 RDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003 RBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768 Add 'in_size' parameter to cxl_payload_from_user_allowed() and validate the payload is large enough. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | dtb-aarch64 opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-64kb opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-64kb sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-azure opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-azure sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-default opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-default sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-default-base opensuse-leap 16.0 | 6.12.0-160000.35.1.160000.2.16 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.60.1.150700.17.35.4 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-default-base sles 16.0 | 6.12.0-160000.35.1.160000.2.16 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-docs opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-docs sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-kvmsmall opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-kvmsmall sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-livepatch-SLE15-SP7-RT_Update_16 sles 15.7 | 1-150700.1.5.2 | [SUSE-SU-2026:2591-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2591-1.md) | Jun 23, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_16 sles 15.7 | 1-150700.15.3.2 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-obs-build opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.60.2 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-obs-qa opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-obs-qa sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-rt opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-source opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-source sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-syms opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-syms sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | kernel-zfcpdump opensuse-leap 16.0 | 6.12.0-160000.35.1 | [OPENSUSE-SU-2026:20965-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20965-1.md) | Jun 15, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-zfcpdump sles 16.0 | 6.12.0-160000.35.1 | [SUSE-SU-2026:22127-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22127-1.md) | Jun 15, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-23327](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23327.md) | Mar 25, 2026 | | Linux | linux Debian 14 | 6.19.8-1 | [DEBIAN-CVE-2026-23327](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23327.md) | Mar 25, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.