UBUNTU-CVE-2026-80662: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXLHEADERLOGSIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXLRASCAPABILITYLENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXLHEADERLOGSIZE was defined as SZ512, eight times the actual on-device size. headerlogcopy() reads CXLHEADERLOGSIZEU32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxlaeruncorrectableerror trace event memcpy()s CXLHEADERLOGSIZE (512) bytes from its source. For the CPER caller the source is struct cxlrascapabilityregs::headerlog[16] (64 bytes) embedded in a stack-local cxlcperproterrworkdata, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs. Set CXLHEADERLOGSIZE to 64 and derive CXLHEADERLOGSIZEU32 from it, bringing all iomap readers into agreement on 16 dwords. Userspace tools such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) headerlog layout in the cxlaeruncorrectableerror trace event. Add CXLHEADERLOGTRACESIZEU32 = 128 and use it for the trace event array and its memcpy to preserve that ABI. Both callers now pass a zero-filled u32[CXLHEADERLOGTRACESIZEU32] staging buffer with only the first CXLHEADERLOGSIZEU32 (16) entries populated from hardware; the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring buffer layout intact. [ dj: Replaced 64 with SZ64 per RichardC ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1038.42 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Configuration
Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it so iomap readers access 16 dwords. Add CXL_HEADERLOG_TRACE_SIZE_U32=128 and use it for the trace event __array and memcpy, with callers supplying a zero-filled 128-u32 staging buffer whose first 16 entries contain the hardware header log, preserving the existing 512-byte trace ABI.
Linux kernel CXL header-log handling CXL_HEADERLOG_SIZE and CXL_HEADERLOG_TRACE_SIZE_U32 = CXL_HEADERLOG_SIZE=64; derive CXL_HEADERLOG_SIZE_U32 from it; CXL_HEADERLOG_TRACE_SIZE_U32=128
Event History
Frequently Asked Questions
Who is realistically exposed to the information disclosure?
Systems using the affected Ubuntu kernel packages where the kernel processes CXL RAS capability header logs are exposed. The disclosed data can be placed in the trace event ring buffer and read from userspace through tracefs.
What level of access does an attacker need?
The severity vector indicates local access with low privileges is required, with no user interaction. The issue can expose kernel stack data through the CXL AER uncorrectable-error trace event.