CVE-2026-80639: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80639 Overview

CVE-2026-80639 affects the Linux kernel's Compute Express Link (CXL) test module. The issue resides in the setup_xor_mapping() function within the cxl_translate test module. Fortify source protection detects a potential buffer overflow when writing to the xormaps array annotated with __counted_by(nr_maps). The runtime assertion triggers a __fortify_panic because nr_maps is initialized after the memcpy operation, making the compiler-visible bound zero at the time of the write. The upstream fix reorders initialization so nr_maps is set before the write, resolving the false positive.

Critical Impact
A __fortify_panic fires during modprobe of the CXL test module, producing a kernel warning and interrupting CXL test initialization on affected builds.

Affected Products

Linux kernel cxl/test subsystem (cxl_translate module)
Kernel builds with CONFIG_FORTIFY_SOURCE enabled
Development and CI environments using CXL test modules

Discovery Timeline

2026-08-28 - CVE-2026-80639 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80639

Vulnerability Analysis

The defect lives in the CXL translation test helper setup_xor_mapping(). The function writes 32 bytes into an xormaps array that carries the __counted_by(nr_maps) annotation. Fortify Source uses this annotation to compute the runtime bound of the destination buffer for memcpy. Because nr_maps was initialized after the copy, Fortify observed an effective buffer size of zero and raised a warning.

The reported kernel log shows the exact behavior:

memcpy: detected buffer overflow: 32 byte write of buffer size 0
WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0
Call Trace:
  __fortify_panic+0xd/0xf
  setup_xor_mapping+0x6c/0xa0 [cxl_translate]

This is a false positive, not a memory-safety flaw. No out-of-bounds write occurs in the underlying allocation. The kernel warning, however, aborts the test path and can disrupt automated kernel testing pipelines. The fix moves the assignment of nr_maps earlier so Fortify's counted-by check sees the correct capacity.

Root Cause

The root cause is ordering of a __counted_by counter relative to a bounded write. When a structure field is annotated with __counted_by(nr_maps), Fortify Source treats nr_maps as authoritative at every write. Setting nr_maps after memcpy invalidates that contract at the moment of the copy.

Attack Vector

This vulnerability is not remotely exploitable. Triggering the warning requires loading the cxl_translate test module, which is restricted to privileged users during kernel testing. The impact is limited to a kernel warning and interrupted test execution rather than privilege escalation or data corruption. See the upstream commits 08326b9 and 8c4f27a for the exact code change.

Detection Methods for CVE-2026-80639

Indicators of Compromise

Kernel log entries containing memcpy: detected buffer overflow: 32 byte write of buffer size 0
WARNING traces referencing __fortify_report and __fortify_panic
Stack frames pointing to setup_xor_mapping+0x6c/0xa0 [cxl_translate] during modprobe

Detection Strategies

Scan dmesg and journal output for __fortify_panic warnings tied to the cxl_translate module.
Track kernel build versions in your fleet and flag hosts running unpatched cxl/test code with CONFIG_FORTIFY_SOURCE enabled.
Include CXL test module load events in kernel testing pipelines to catch the warning in pre-production.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on __fortify_panic and __fortify_report strings.
Monitor modprobe invocations of cxl_translate on lab and CI systems for warning traces.
Correlate kernel warning events with kernel package versions to prioritize patching.

How to Mitigate CVE-2026-80639

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 08326b9 and 8c4f27a.
Rebuild and redeploy kernels used for CXL testing in lab and CI environments.
Restrict modprobe of the cxl_translate test module to trusted operators.

Patch Information

The fix reorders initialization inside setup_xor_mapping() so nr_maps is assigned before the memcpy that writes into the xormaps array. This aligns the runtime value of the __counted_by field with Fortify Source expectations and eliminates the false-positive __fortify_panic. Pull the stable kernel updates that include the referenced commits and confirm your distribution's kernel package incorporates them.

Workarounds

Avoid loading the cxl_translate test module on kernels that lack the fix.
Build test kernels without CONFIG_FORTIFY_SOURCE only in isolated lab environments where the tradeoff is acceptable.
Pin CI runners to kernel builds that include the patched setup_xor_mapping() implementation.

bash

# Verify the cxl_translate module is not auto-loaded on production hosts
lsmod | grep cxl_translate
echo 'blacklist cxl_translate' | sudo tee /etc/modprobe.d/blacklist-cxl-translate.conf
sudo depmod -a