CVE-2026-80662

Received Received - Intake

Buffer Overflow in Linux Kernel CXL Driver

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512, eight times the actual on-device size. header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE (512) bytes from its source. For the CPER caller the source is struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs. Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it, bringing all iomap readers into agreement on 16 dwords. Userspace tools such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) header_log layout in the cxl_aer_uncorrectable_error trace event. Add CXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event __array and its memcpy to preserve that ABI. Both callers now pass a zero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only the first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware; the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring buffer layout intact. [ dj: Replaced 64 with SZ_64 per RichardC ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80662

EUVD

EUVD-2026-67538

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	cxl	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's CXL (Compute Express Link) driver. It occurs because the kernel incorrectly defines the size of the CXL header log as 512 bytes instead of the actual 64 bytes specified in the hardware standard. This causes the kernel to read and copy 448 extra bytes from kernel memory into a trace buffer, which userspace can access via tracefs.

Detection Guidance

This vulnerability is specific to the Linux kernel's CXL (Compute Express Link) RAS (Reliability, Availability, and Serviceability) capability handling. Detection requires checking kernel versions and CXL driver behavior. Inspect kernel logs for CXL-related errors or trace events using commands like dmesg | grep cxl or cat /sys/kernel/debug/tracing/trace_pipe. Verify CXL_HEADERLOG_SIZE and related macros in kernel headers.

Impact Analysis

An attacker with local access could exploit this to read sensitive kernel memory, potentially exposing passwords, encryption keys, or other confidential data. The vulnerability allows unauthorized access to kernel stack memory through the tracefs interface.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a memory overread in the Linux kernel's CXL driver, which could expose kernel stack data to userspace via tracefs. While this may raise security concerns, there is no evidence it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to fix the CXL_HEADERLOG_SIZE misconfiguration. Update the kernel to a version containing the fix for CVE-2026-80662. Monitor vendor advisories for CXL driver updates. If using custom kernels, recompile with the corrected CXL_HEADERLOG_SIZE and CXL_HEADERLOG_SIZE_U32 values.

Hi! I’m here to help you understand CVE-2026-80662. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70