CVE-2026-80640 Overview
CVE-2026-80640 is a Linux kernel vulnerability affecting the Compute Express Link (CXL) firmware control (fwctl) subsystem. The issue triggers a runtime __fortify_panic assertion inside cxlctl_get_supported_features(). The kernel's fortify-source hardening reports a memcpy buffer overflow of 48 bytes into a zero-sized destination. The warning is a false positive caused by ordering: the @num_entries field annotated with __counted_by_le() is initialized after the copy, so fortify sees the destination as size zero. The fix reorders initialization so num_entries is set before the memcpy, silencing the panic and preventing kernel warnings that could disrupt CXL device feature enumeration.
Critical Impact
Triggering the fortify panic in cxlctl_get_supported_features() produces kernel warnings on affected systems using CXL fwctl, degrading availability of feature discovery paths.
Affected Products
- Linux kernel cxl_core module with fwctl support
- Kernel branches referenced by stable commits 18c67ec, 6c9d2e8, and b8d15e8
- Systems using CXL devices exposing supported-features firmware commands
Discovery Timeline
- 2026-08-28 - CVE-2026-80640 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80640
Vulnerability Analysis
The defect resides in cxlctl_get_supported_features() within the CXL core (cxl_core) kernel module. The function copies feature entries into an array member annotated with __counted_by_le(num_entries). Fortify-source uses that annotation at runtime to bound-check memcpy destinations. Because the code performed the memcpy before assigning num_entries, the compiler-instrumented check saw a destination capacity of zero and reported memcpy: detected buffer overflow: 48 byte write of buffer size 0. The resulting call chain reaches __fortify_panic via __fortify_report, producing a kernel warning during normal CXL feature enumeration.
Root Cause
The root cause is initialization ordering around a __counted_by_le-annotated flexible array. Fortify-source evaluates the counter field at the point of the copy. Writing entries prior to setting the counter violates the runtime contract enforced by the annotation, even when the underlying allocation is correctly sized. The patch moves the assignment of num_entries before the memcpy so that fortify sees the correct capacity.
Attack Vector
No remote attack vector is documented. The condition is reached during standard CXL firmware control operations that request supported features. Local invocation of fwctl interfaces against a CXL device triggers the warning. The issue affects reliability rather than confidentiality or integrity, and no proof-of-concept or exploit is published in the referenced advisories. See the Kernel Git Commit 18c67ec, Kernel Git Commit 6c9d2e8, and Kernel Git Commit b8d15e8 for the exact source changes.
Detection Methods for CVE-2026-80640
Indicators of Compromise
- Kernel log entries containing memcpy: detected buffer overflow: 48 byte write of buffer size 0.
- WARNING traces referencing __fortify_report and __fortify_panic with cxlctl_get_supported_features.cold in the call stack.
- Warnings originating from the fwctl kernel thread on hosts with CXL devices.
Detection Strategies
- Parse dmesg and /var/log/kern.log for the specific fortify panic signature above.
- Query kernel build metadata (uname -r, distribution changelogs) to identify hosts running cxl_core versions without the fix commits.
- Correlate CXL device presence (lspci | grep -i cxl, /sys/bus/cxl/) with kernel version to prioritize impacted systems.
Monitoring Recommendations
- Forward kernel logs to a centralized logging pipeline and alert on __fortify_panic and __fortify_report strings.
- Track patch state for the CXL core module across the fleet through configuration management inventory.
- Monitor for repeated CXL feature-query failures that may indicate applications retrying against a warning-affected code path.
How to Mitigate CVE-2026-80640
Immediate Actions Required
- Apply the upstream kernel stable updates that include commits 18c67ec, 6c9d2e8, and b8d15e8 to the cxl_core module.
- Prioritize patching on hosts with CXL-attached memory or accelerator devices where fwctl is exercised.
- Rebuild and redeploy any out-of-tree kernel modules that depend on the patched CXL core API.
Patch Information
The fix reorders assignment of @num_entries so it precedes the memcpy covered by __counted_by_le(num_entries). Distribution kernels should incorporate the fix via the stable kernel commits listed in the Kernel Git Commit 18c67ec, Kernel Git Commit 6c9d2e8, and Kernel Git Commit b8d15e8 references.
Workarounds
- Avoid invoking CXL supported-features queries through fwctl on unpatched kernels until updates are staged.
- Where feasible, unload or disable the cxl_core module on hosts that do not require CXL functionality.
- Suppress downstream alert noise by filtering the known fortify signature only after confirming the host is scheduled for patching.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.