CVE-2026-80662: Linux Kernel CXL Information Disclosure Flaw

CVE-2026-80662 Overview

CVE-2026-80662 is an out-of-bounds read vulnerability in the Linux kernel's Compute Express Link (CXL) subsystem. The flaw stems from a mismatch between the defined CXL_HEADERLOG_SIZE constant (512 bytes) and the actual on-device Header Log size (64 bytes) in the CXL r4.0 RAS Capability Structure. When the kernel processes CXL Advanced Error Reporting (AER) uncorrectable errors, the header_log_copy() routine reads 128 dwords from a memory-mapped I/O region that is only 88 bytes long, and the cxl_aer_uncorrectable_error trace event copies 512 bytes from a 64-byte source. Local users can read the resulting kernel stack data via tracefs.

Critical Impact
A local low-privileged user with access to tracefs can read 448 bytes of leaked kernel stack memory from the trace ring buffer, exposing sensitive kernel data that may aid further exploitation.

Affected Products

Linux kernel with CXL subsystem enabled
Systems using CXL memory devices reporting RAS capability
Stable kernel branches prior to fixes 6fc1919a, c268f949, and fc5eb096

Discovery Timeline

2026-08-28 - CVE-2026-80662 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80662

Vulnerability Analysis

The CXL r4.0 specification section 8.2.4.17.7 defines the RAS Capability Structure as 0x58 bytes total, with the Header Log occupying the trailing 64 bytes at offset 0x18. The Linux kernel incorrectly defined CXL_HEADERLOG_SIZE as SZ_512, eight times the true hardware size. This constant governs two independent code paths that both exceed their source buffers.

The first path, header_log_copy(), iterates CXL_HEADERLOG_SIZE_U32 (128) dwords from the RAS capability iomap. Because the mapping is only 88 bytes, the loop reads 448 bytes past the mapped region. The second path is the cxl_aer_uncorrectable_error trace event. Its memcpy() copies 512 bytes from struct cxl_ras_capability_regs::header_log[16], a 64-byte array. For the CPER caller, this source is embedded in a stack-local cxl_cper_prot_err_work_data, so 448 bytes of adjacent kernel stack memory land in the trace ring buffer.

Root Cause

The root cause is an incorrect size constant. CXL_HEADERLOG_SIZE was defined at eight times the specification-mandated Header Log length, creating a mismatch between the constant used by iomap readers and trace event consumers and the actual hardware structure size.

Attack Vector

Exploitation requires local access with permission to read kernel trace events under tracefs. On systems where the CXL RAS trace event fires, an unprivileged process able to read /sys/kernel/tracing/ receives 448 bytes of kernel stack contents per event. This constitutes an information disclosure primitive suitable for defeating KASLR or leaking secrets embedded in kernel stack frames. The fix sets CXL_HEADERLOG_SIZE to SZ_64, derives CXL_HEADERLOG_SIZE_U32 from it, and introduces CXL_HEADERLOG_TRACE_SIZE_U32 = 128 with zero-padded staging buffers to preserve the ABI expected by userspace tools such as rasdaemon.

See the upstream fix in Kernel Git Commit 6fc1919a for the complete patch.

Detection Methods for CVE-2026-80662

Indicators of Compromise

Unexpected processes reading from /sys/kernel/tracing/events/cxl/cxl_aer_uncorrectable_error/ or /sys/kernel/debug/tracing/
Non-root or non-monitoring processes opening trace_pipe or trace files under tracefs
Elevated CXL AER uncorrectable error trace event volume on systems with CXL memory

Detection Strategies

Audit access to tracefs and debugfs mount points using kernel audit rules on open() and read() syscalls targeting those paths
Monitor for local user processes reading trace ring buffers outside of authorized telemetry agents such as rasdaemon
Correlate CXL AER trace event generation with subsequent tracefs reads by non-privileged users

Monitoring Recommendations

Deploy Linux auditd rules covering /sys/kernel/tracing and /sys/kernel/debug/tracing file access
Alert on mount operations that expose tracefs with permissive access modes
Track kernel version inventory to identify hosts running unpatched CXL-enabled kernels

How to Mitigate CVE-2026-80662

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 6fc1919a, c268f949, and fc5eb096 as soon as vendor backports become available
Restrict access to tracefs and debugfs to root or a dedicated monitoring group by remounting with appropriate mode= and gid= options
Inventory hosts with CXL memory devices and prioritize patching for systems that emit CXL RAS events

Patch Information

The fix redefines CXL_HEADERLOG_SIZE to SZ_64 and derives CXL_HEADERLOG_SIZE_U32 from it, aligning all iomap readers at 16 dwords. A new CXL_HEADERLOG_TRACE_SIZE_U32 constant of 128 preserves the 512-byte trace ring buffer layout that rasdaemon depends on, with the trailing 112 dwords zero-padded. Patches are available at Kernel Git Commit 6fc1919a, Kernel Git Commit c268f949, and Kernel Git Commit fc5eb096.

Workarounds

Unmount tracefs or restrict permissions so only root can read trace events on CXL-enabled hosts until patches are applied
Disable the cxl_core and cxl_pci modules on systems that do not require CXL functionality
Remove read access to /sys/kernel/tracing/events/cxl/ for non-privileged users using filesystem ACLs

bash

# Restrict tracefs access to root only
mount -o remount,mode=0700,gid=0 /sys/kernel/tracing
chmod -R o-rwx /sys/kernel/debug/tracing

# Verify no unauthorized users can read CXL trace events
ls -l /sys/kernel/tracing/events/cxl/cxl_aer_uncorrectable_error/