CVE-2026-80662 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512, eight times the actual on-device size.
header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE (512) bytes from its source. For the CPER caller the source is struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a
stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs.
Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it, bringing all iomap readers into agreement on 16 dwords. Userspace tools such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) header_log layout in the cxl_aer_uncorrectable_error trace event. Add CXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event __array and its memcpy to preserve that ABI. Both callers now pass a zero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only
the first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware; the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring buffer layout intact.
[ dj: Replaced 64 with SZ_64 per RichardC ]
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel driver for Compute Express Link (CXL) devices contained a critical memory safety vulnerability stemming from an incorrect definition of the header log size within the RAS Capability structure. According to the CXL specification revision 4.0 section 8.2.4.17.7, the total length of the RAS Capability Structure is defined as 0x58 bytes, with the Header Log occupying a trailing segment of exactly sixty-four bytes at offset 0x18. However, the kernel code erroneously defined CXL_HEADERLOG_SIZE as SZ_512, which corresponds to five hundred twelve bytes or eight times the actual hardware-defined size. This discrepancy created a significant mismatch between the documented specification and the implementation logic used by the driver to access device registers.
This misconfiguration led directly to an out-of-bounds read operation when the header_log_copy function was invoked. The function attempted to read CXL_HEADERLOG_SIZE_U32, calculated as one hundred twenty-eight double words from the RAS capability memory-mapped I/O region. Since the actual mapping for this structure is only eighty-eight bytes long in many contexts or strictly limited by the hardware definition of sixty-four bytes for the log itself, reading five hundred twelve bytes resulted in a buffer overread that extended forty-four bytes beyond the allocated iomap boundary. This constitutes an out-of-bounds read vulnerability where the kernel accesses memory regions it does not own or should not access based on the device's declared capabilities.
The operational impact of this flaw is particularly severe due to how the corrupted data was propagated through the system. The cxl_aer_uncorrectable_error trace event utilized a memcpy operation that copied five hundred twelve bytes from its source buffer into the kernel ring buffer used for tracing events. For CPER callers, the source of this copy was struct cxl_ras_capability_regs::header_log embedded within a stack-local structure named cxl_cper_prot_err_work_data. Consequently, when an error occurred and this code path was executed, the driver read four hundred forty-eight bytes of adjacent kernel stack memory into the trace event buffer. This data is subsequently exposed to userspace applications via tracefs, effectively leaking sensitive kernel stack contents that may contain pointers, cryptographic keys, or other private information from previous function calls on that stack frame.
From a classification perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write if the overread leads to subsequent corruption, though primarily it is an information disclosure issue similar to CWE-200 Exposure of Sensitive Information Through Information Retrieval. In terms of MITRE ATT&CK techniques, this behavior facilitates Data from Local System via Trace Events or Logs, allowing a local user with access to tracefs to harvest kernel memory contents that were not intended for public consumption. The vulnerability highlights the risks associated with trusting hardcoded constants over specification-defined limits and failing to validate buffer sizes against actual hardware constraints during driver development.
To mitigate this issue while maintaining backward compatibility with existing userspace tools, the fix involved a nuanced adjustment rather than a simple truncation of the array size. Userspace utilities such as rasdaemon had developed dependencies on the buggy five hundred twelve-byte layout within the cxl_aer_uncorrectable_error trace event. Therefore, simply reducing the copied data would have broken these applications. The resolution set CXL_HEADERLOG_SIZE to sixty-four bytes and derived CXL_HEADERLOG_SIZE_U32 from it to ensure all internal iomap readers agreed on a sixteen double-word limit for actual hardware interaction. Simultaneously, a new constant CXL_HEADERLOG_TRACE_SIZE_U32 was introduced with a value of one hundred twenty-eight to preserve the ABI for trace events.
The implementation strategy involved using a zero-filled staging buffer sized at CXL_HEADERLOG_TRACE_SIZE_U32 for both callers. The driver now populates only the first sixteen entries from hardware data into this buffer, while the remaining one hundred twelve double words are explicitly zero-padded before being copied to the ring buffer. This approach ensures that the trace event continues to present a consistent five hundred twelve-byte layout to userspace tools, preventing regression in monitoring software, while strictly limiting the actual memory read operations to safe boundaries defined by the hardware specification and kernel stack limits. This dual-layered fix addresses both the security flaw of overreading kernel memory and the functional requirement of maintaining compatibility with established ecosystem tooling.