CVE-2026-80662

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size

The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58

bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing

64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512,

eight times the actual on-device size.

header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the

RAS capability iomap, overrunning the 88-byte mapping by 448 bytes.

The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE

(512) bytes from its source. For the CPER caller the source is

struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a

stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes

of kernel stack into the trace event ring buffer where userspace can

read it via tracefs.

Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it,

bringing all iomap readers into agreement

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References