The vulnerability in the Linux kernel's cxl/features subsystem involved the fwctl_cmd_rpc() function copying cmd->in_len bytes into a buffer without proper validation of the user-controlled op_size parameter. The callback cxlctl_fw_rpc() ignored in_len and did not check op_size against it, allowing op_size to be larger than the allocated buffer. This caused out-of-bounds reads when cxlctl_set_feature() read op_size - sizeof(hdr) bytes, potentially reading unmapped memory and causing kernel oops. The vulnerability was mitigated by rejecting any request where the fixed header plus op_size exceeds the copied buffer size, ensuring safe bounds before processing.

This vulnerability can lead to out-of-bounds memory reads in kernel space, which may cause kernel crashes (kernel oops) and potentially destabilize the system. There is no explicit mention of privilege escalation or code execution, but kernel crashes can lead to denial of service conditions.

A fix has been implemented that rejects any fwctl command requests where the combined fixed header and op_size exceed the allocated input buffer size. Users should apply the official Linux kernel update that includes this fix to prevent exploitation. No additional mitigation steps are indicated.