Bug 2502585 (CVE-2026-64101)

Summary: CVE-2026-64101 kernel: fwctl: pds: Validate RPC input size before parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's fwctl component. Insufficient validation of the Remote Procedure Call (RPC) input buffer size in the pdsfc_fw_rpc() function can lead to an out-of-bounds read. A local attacker could exploit this vulnerability by providing a specially crafted RPC input, potentially leading to information disclosure or a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 17:07:32 UTC 
In the Linux kernel, the following vulnerability has been resolved:

fwctl: pds: Validate RPC input size before parsing

The fwctl core allocates the device-specific RPC input buffer with
fwctl_rpc.in_len and passes that buffer to the driver callback.

pdsfc_fw_rpc() casts the buffer to struct fwctl_rpc_pds and then calls
pdsfc_validate_rpc(), which reads fields from that structure before
checking that the input buffer is large enough to contain it. A short
in_len can make pds_fwctl read beyond the allocation.

Reject pds RPC buffers that are smaller than struct fwctl_rpc_pds before
parsing any pds-specific fields.
Comment 1 TEJ RATHI 2026-07-20 06:37:06 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64101-0c9a@gregkh/T