CVE-2026-80640: cxl/fwctl: Fix __fortify_panic
In the Linux kernel, the following vulnerability has been resolved:
cxl/fwctl: Fix fortifypanic
Fix a runtime assertion in cxlctlgetsupportedfeatures(). Fortify complains that it is potentially overflowing the entries array per countedbyle(numentries). Quiet the false positive by initializing @numentries earlier.
memcpy: detected buffer overflow: 48 byte write of buffer size 0 WARNING: lib/stringhelpers.c:1036 at fortifyreport+0x4d/0xa0, CPU#7: fwctl/1398 RIP: 0010:fortifyreport+0x50/0xa0 Call Trace: fortifypanic+0xd/0xf cxlctlgetsupportedfeatures.cold+0x23/0x35 [cxlcore]
Affected Software
Event History
Frequently Asked Questions
Is this described as a confirmed memory corruption issue?
The report characterizes the Fortify overflow report as a false positive. The assertion occurs because num_entries is initialized after the entries array is checked through __counted_by_le(num_entries).
What kernel activity triggers the reported failure?
The warning is reported from cxlctl_get_supported_features() in the cxl_core module, during a supported-features query in the CXL fwctl path. The supplied data does not identify a network-reachable or unprivileged attack path.
How can I identify systems exhibiting this issue?
Look for a Fortify buffer-overflow report stating "48 byte write of buffer size 0" and a call trace containing __fortify_panic and cxlctl_get_supported_features.cold in cxl_core.
What is the documented fix?
The fix initializes num_entries earlier, before the entries array is evaluated by the Fortify counted-by check. No affected or fixed Linux kernel version numbers are provided.