CVE-2026-80640: cxl/fwctl: Fix __fortify_panic
In the Linux kernel, the following vulnerability has been resolved:
cxl/fwctl: Fix fortifypanic
Fix a runtime assertion in cxlctlgetsupportedfeatures(). Fortify complains that it is potentially overflowing the entries array per countedbyle(numentries). Quiet the false positive by initializing @numentries earlier.
memcpy: detected buffer overflow: 48 byte write of buffer size 0 WARNING: lib/stringhelpers.c:1036 at fortifyreport+0x4d/0xa0, CPU#7: fwctl/1398 RIP: 0010:fortifyreport+0x50/0xa0 Call Trace: fortifypanic+0xd/0xf cxlctlgetsupportedfeatures.cold+0x23/0x35 [cxlcore]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
Linux kernel cxl/fwctlto a version that resolves this vulnerability.Patch cxl/fwctl: Fix __fortify_panic
Event History
Frequently Asked Questions
Is this described as a confirmed memory corruption issue?
The report characterizes the Fortify overflow report as a false positive. The assertion occurs because num_entries is initialized after the entries array is checked through __counted_by_le(num_entries).
What kernel activity triggers the reported failure?
The warning is reported from cxlctl_get_supported_features() in the cxl_core module, during a supported-features query in the CXL fwctl path. The supplied data does not identify a network-reachable or unprivileged attack path.
How can I identify systems exhibiting this issue?
Look for a Fortify buffer-overflow report stating "48 byte write of buffer size 0" and a call trace containing __fortify_panic and cxlctl_get_supported_features.cold in cxl_core.
What is the documented fix?
The fix initializes num_entries earlier, before the entries array is evaluated by the Fortify counted-by check. No affected or fixed Linux kernel version numbers are provided.