Cloudanix VulnDB

CVE-2026-80662

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can let a logged-in user peek at pieces of the computer's hidden internal memory that should stay private.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in header_log_copy() and cxl_aer_uncorrectable_error trace event copies 512 bytes instead of the actual 64-byte RAS header log, pulling adjacent kernel stack contents into a userspace-readable tracefs buffer.

Why it matters to the business

Local users or processes can obtain fragments of kernel memory that may contain sensitive data such as credentials or addresses; the same path can also destabilize tracing infrastructure.

How an attack unfolds

An attacker with local access triggers a CXL AER uncorrectable error path, causing the kernel to populate the cxl_aer_uncorrectable_error trace event; the oversized memcpy pulls kernel-stack bytes into the ring buffer, which the attacker then reads through tracefs.

How to fix it

Update the Linux kernel to the version containing the corrected CXL_HEADERLOG_SIZE definition (64 bytes) together with the CXL_HEADERLOG_TRACE_SIZE_U32 compatibility shim; rebuild and reboot any affected CXL-enabled kernels.

How to confirm the fix worked

Confirm the running kernel contains the patch that sets CXL_HEADERLOG_SIZE to SZ_64 and uses a zero-padded staging buffer for the trace event; inspect the trace event definition to verify the first 16 u32 values originate from hardware while the remaining 112 are zero.

Typical attack path

  1. Obtain local execution on a system exposing CXL RAS capabilities
  2. Induce or wait for an AER uncorrectable error that invokes the CXL trace event
  3. Open the cxl_aer_uncorrectable_error trace file via tracefs
  4. Read the oversized header_log field to extract leaked stack bytes

How to detect it

Review tracefs access logs and cxl_aer_uncorrectable_error events for unexpected or repeated reads; correlate with process execution that opens trace event files shortly after hardware error injection or CXL device activity.

What your security team should do

  • Prioritize kernel updates on all systems that expose CXL RAS registers
  • Restrict tracefs access to the minimum necessary users via mount options or permissions
  • Monitor EPSS and vendor advisories for any subsequent exploit maturity increase

The record

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512, eight times the actual on-device size. header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE (512) bytes from its source. For the CPER caller the source is struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs. Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it, bringing all iomap readers into agreement on 16 dwords. Userspace tools such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) header_log layout in the cxl_aer_uncorrectable_error trace event. Add CXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event __array and its memcpy to preserve that ABI. Both callers now pass a zero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only the first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware; the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring buffer layout intact. [ dj: Replaced 64 with SZ_64 per RichardC ]

Affected packages

Ecosystem Package Introduced Fixed