CVE-2026-80639
Received Received - Intake

Buffer Overflow in Linux Kernel CXL Test Module

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix __fortify_panic Fix a runtime assertion in setup_xor_mapping(). Fortify complains that it is potentially overflowing the xormaps array per __counted_by(nr_maps). Quiet the false positive by initializing @nr_maps earlier. memcpy: detected buffer overflow: 32 byte write of buffer size 0 WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#8: modprobe/2728 Call Trace: __fortify_panic+0xd/0xf setup_xor_mapping+0x6c/0xa0 [cxl_translate] [ dj: Fixed up @nr_entries to @nr_maps in commit log. ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80639
EUVD
EUVD-2026-67515

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a runtime assertion failure in the CXL (Compute Express Link) test module. The issue occurs in setup_xor_mapping() where Fortify detects a potential buffer overflow in the xormaps array due to an uninitialized variable @nr_maps. The fix initializes @nr_maps earlier to prevent the false positive assertion.

Detection Guidance

This vulnerability is specific to the Linux kernel's cxl/test module and may trigger a buffer overflow warning during module initialization. Detection involves checking kernel logs for fortify warnings or buffer overflow messages related to cxl_translate or setup_xor_mapping. Monitor dmesg or journalctl for errors like 'memcpy: detected buffer overflow' or '__fortify_panic'.

Impact Analysis

This vulnerability may cause system crashes or instability when the CXL test module is executed, particularly if the kernel's Fortify feature is enabled. It could lead to kernel panics or unexpected behavior during system operations involving CXL devices.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-risk buffer overflow false positive in the Linux kernel's cxl/test module, resolved by initializing a variable earlier. No data exposure or security impact is indicated.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-80639. If immediate patching is not possible, disable the cxl module if not required by unloading it with 'modprobe -r cxl_translate' or blacklisting it. Monitor kernel logs for related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80639. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart