CVE-2026-64101

In the Linux kernel, the following vulnerability has been resolved:

fwctl: pds: Validate RPC input size before parsing

The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback.

pdsfcfwrpc() casts the buffer to struct fwctlrpcpds and then calls pdsfcvalidaterpc(), which reads fields from that structure before checking that the input buffer is large enough to contain it. A short inlen can make pdsfwctl read beyond the allocation.

Reject pds RPC buffers that are smaller than struct fwctlrpcpds before parsing any pds-specific fields.