CVE-2026-80662: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size

Published Aug 28, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

cxl: Fix CXLHEADERLOGSIZE to match RAS Capability size

The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXLRASCAPABILITYLENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXLHEADERLOGSIZE was defined as SZ512, eight times the actual on-device size.

headerlogcopy() reads CXLHEADERLOGSIZEU32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxlaeruncorrectableerror trace event memcpy()s CXLHEADERLOGSIZE (512) bytes from its source. For the CPER caller the source is struct cxlrascapabilityregs::headerlog[16] (64 bytes) embedded in a stack-local cxlcperproterrworkdata, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs.

Set CXLHEADERLOGSIZE to 64 and derive CXLHEADERLOGSIZEU32 from it, bringing all iomap readers into agreement on 16 dwords. Userspace tools such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) headerlog layout in the cxlaeruncorrectableerror trace event. Add CXLHEADERLOGTRACESIZEU32 = 128 and use it for the trace event array and its memcpy to preserve that ABI. Both callers now pass a zero-filled u32[CXLHEADERLOGTRACESIZEU32] staging buffer with only the first CXLHEADERLOGSIZEU32 (16) entries populated from hardware; the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring buffer layout intact.

[ dj: Replaced 64 with SZ64 per RichardC ]

Affected Software

1 affected component
Linux Kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Set CXL_HEADERLOG_SIZE to 64 (instead of CXL_HEADERLOG_SIZE being SZ_512) so the CXL header log in cxl_aer_uncorrectable_error and other trace buffers matches the RAS Capability Structure size.

    Linux kernel CXL RAS header log CXL_HEADERLOG_SIZE = 64
  2. Configuration

    Derive CXL_HEADERLOG_SIZE_U32 from CXL_HEADERLOG_SIZE so the trace event memcpy() copies only the correct number of 32-bit dwords (CXL_HEADERLOG_SIZE was defined as SZ_512, and the fix states CXL_HEADERLOG_TRACE_SIZE_U32 is 128; userspace/ABI alignment uses __array/memcpy changes).

    Linux kernel CXL RAS header log CXL_HEADERLOG_SIZE_U32 = derived from CXL_HEADERLOG_SIZE
  3. Compensating control

    Ensure userspace trace consumers (e.g., rasdaemon) use the corrected ABI/layout where the header_log in cxl_aer_uncorrectable_error is sized to the on-device RAS capability (64 bytes / 16 dwords), with remaining entries zero-padded as described.

Event History

Aug 28, 2026
CVE Published
via MITRE·06:49 AM
Data Sourced
via MITRE·06:49 AM
Description

Frequently Asked Questions

1

Which systems are exposed to the information leak?

Exposure is limited to systems using the CXL RAS capability path that emits the cxl_aer_uncorrectable_error trace event. The affected code reads beyond the 88-byte RAS capability mapping and can copy excess kernel stack data into the trace event buffer.

2

What would an attacker need to obtain leaked data?

The leak becomes available through the trace event ring buffer, which userspace can read via tracefs. An attacker would need access to the relevant tracefs event data after the affected CXL error path is exercised.

3

What data may be disclosed?

The trace-event memcpy can read 512 bytes from a 64-byte header-log array in a stack-local structure. This can disclose up to 448 bytes of adjacent kernel stack data in the trace event.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203