GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80662 (GCVE-0-2026-80662)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:49 – Updated: 2026-08-29 06:21
VLAI
Title
cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512, eight times the actual on-device size. header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE (512) bytes from its source. For the CPER caller the source is struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs. Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it, bringing all iomap readers into agreement on 16 dwords. Userspace tools such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) header_log layout in the cxl_aer_uncorrectable_error trace event. Add CXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event __array and its memcpy to preserve that ABI. Both callers now pass a zero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only the first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware; the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring buffer layout intact. [ dj: Replaced 64 with SZ_64 per RichardC ]
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2905cb5236cba63a5dc8a83752dcc31f3cc819f9 , < 6fc1919a6f2ed541484dd1f6cd93374044f8fd3d (git)
Affected: 2905cb5236cba63a5dc8a83752dcc31f3cc819f9 , < fc5eb0962a5e50d64e711817cc24d67df2d90528 (git)
Affected: 2905cb5236cba63a5dc8a83752dcc31f3cc819f9 , < c268f949e219f9e179558e836f457f6c5fbec416 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/ras.c",
            "drivers/cxl/core/trace.h",
            "drivers/cxl/cxl.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6fc1919a6f2ed541484dd1f6cd93374044f8fd3d",
              "status": "affected",
              "version": "2905cb5236cba63a5dc8a83752dcc31f3cc819f9",
              "versionType": "git"
            },
            {
              "lessThan": "fc5eb0962a5e50d64e711817cc24d67df2d90528",
              "status": "affected",
              "version": "2905cb5236cba63a5dc8a83752dcc31f3cc819f9",
              "versionType": "git"
            },
            {
              "lessThan": "c268f949e219f9e179558e836f457f6c5fbec416",
              "status": "affected",
              "version": "2905cb5236cba63a5dc8a83752dcc31f3cc819f9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/ras.c",
            "drivers/cxl/core/trace.h",
            "drivers/cxl/cxl.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size\n\nThe CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58\nbytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing\n64 bytes at offset 0x18.  CXL_HEADERLOG_SIZE was defined as SZ_512,\neight times the actual on-device size.\n\nheader_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the\nRAS capability iomap, overrunning the 88-byte mapping by 448 bytes.\nThe cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE\n(512) bytes from its source.  For the CPER caller the source is\nstruct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a\nstack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes\nof kernel stack into the trace event ring buffer where userspace can\nread it via tracefs.\n\nSet CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it,\nbringing all iomap readers into agreement on 16 dwords.  Userspace tools\nsuch as rasdaemon have grown a dependency on the buggy 512-byte (128 u32)\nheader_log layout in the cxl_aer_uncorrectable_error trace event.  Add\nCXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event\n__array and its memcpy to preserve that ABI.  Both callers now pass a\nzero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only\nthe first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware;\nthe remaining 112 u32s are zero-padded, keeping the 512-byte trace ring\nbuffer layout intact.\n\n[ dj: Replaced 64 with SZ_64 per RichardC ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reached in kernel CXL RAS error handling (cxl_handle_ras via PCI AER cxl_error_detected, and CPER paths cxl_cper_post_prot_err/extlog_cxl_cper_handle_prot_err). Disclosure requires reading tracefs; there is no network, adjacent-radio, or direct physical-bus syscall entry to the vulnerable memcpy/readl sites.\nAC:L - With CAP_SYS_ADMIN, ACPI/CXL EINJ via debugfs einj_inject deterministically injects uncorrectable CXL protocol errors that traverse cxl_cper_handle_prot_err/cxl_handle_ras. Without root, a tracing-group member on CXL servers running rasdaemon can reliably capture the leak whenever organic uncorrectable RAS events occur.\nPR:L - Exploitation requires reading cxl_aer_uncorrectable_error data from tracefs (TRACE_MODE_READ 0440), routinely granted to tracing-group/rasdaemon service accounts on CXL/RAS deployments. Triggering on demand uses debugfs EINJ (root) or natural hardware errors; no init-namespace-only capability beyond tracefs DAC is needed for the stack leak.\nUI:N - Once CXL tracepoints are enabled (as rasdaemon does automatically), uncorrectable RAS/CPER processing copies the overlong header_log during kernel error handling. No victim mount, login, or interactive action is required beyond the attacker (or environment) having tracefs access when an error fires.\nS:U - The flaw leaks kernel stack/MMIO data into the trace ring buffer within the host kernel. Impact stays in the same OS security authority (local privilege/information gain) and does not cross guest/host, IOMMU, or container hardware trust boundaries.\nC:H - TP_fast_assign memcpy() copies 512 bytes from a 64-byte ras_cap.header_log on the stack, leaking 448 bytes of kernel stack into tracefs. header_log_copy() also readl()s 128 dwords from an 88-byte RAS iomap, an out-of-bounds read of adjacent MMIO/device memory.\nI:N - Both failure modes are out-of-bounds reads only (stack and MMIO). The trace event stores leaked bytes in the ring buffer but does not corrupt attacker-controlled memory or provide a direct arbitrary-write primitive.\nA:H - header_log_copy() performs 448 bytes of MMIO reads past the devm_ioremap() RAS window (0x58 bytes), which can provoke CPU/MMU faults or platform errors on out-of-range readl(). Uncorrectable-error handling itself can disable CXL.mem devices and force resets, impacting availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:47.605Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6fc1919a6f2ed541484dd1f6cd93374044f8fd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc5eb0962a5e50d64e711817cc24d67df2d90528"
        },
        {
          "url": "https://git.kernel.org/stable/c/c268f949e219f9e179558e836f457f6c5fbec416"
        }
      ],
      "title": "cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80662",
    "datePublished": "2026-08-28T06:49:06.277Z",
    "dateReserved": "2026-08-26T14:34:25.781Z",
    "dateUpdated": "2026-08-29T06:21:47.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80662",
      "date": "2026-09-16",
      "epss": "0.00124",
      "percentile": "0.02439"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80662\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:51.397\",\"lastModified\":\"2026-08-29T07:16:48.667\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size\\n\\nThe CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58\\nbytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing\\n64 bytes at offset 0x18.  CXL_HEADERLOG_SIZE was defined as SZ_512,\\neight times the actual on-device size.\\n\\nheader_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the\\nRAS capability iomap, overrunning the 88-byte mapping by 448 bytes.\\nThe cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE\\n(512) bytes from its source.  For the CPER caller the source is\\nstruct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a\\nstack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes\\nof kernel stack into the trace event ring buffer where userspace can\\nread it via tracefs.\\n\\nSet CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it,\\nbringing all iomap readers into agreement on 16 dwords.  Userspace tools\\nsuch as rasdaemon have grown a dependency on the buggy 512-byte (128 u32)\\nheader_log layout in the cxl_aer_uncorrectable_error trace event.  Add\\nCXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event\\n__array and its memcpy to preserve that ABI.  Both callers now pass a\\nzero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only\\nthe first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware;\\nthe remaining 112 u32s are zero-padded, keeping the 512-byte trace ring\\nbuffer layout intact.\\n\\n[ dj: Replaced 64 with SZ_64 per RichardC ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/cxl/core/ras.c\",\"drivers/cxl/core/trace.h\",\"drivers/cxl/cxl.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2905cb5236cba63a5dc8a83752dcc31f3cc819f9\",\"lessThan\":\"6fc1919a6f2ed541484dd1f6cd93374044f8fd3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2905cb5236cba63a5dc8a83752dcc31f3cc819f9\",\"lessThan\":\"fc5eb0962a5e50d64e711817cc24d67df2d90528\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2905cb5236cba63a5dc8a83752dcc31f3cc819f9\",\"lessThan\":\"c268f949e219f9e179558e836f457f6c5fbec416\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/cxl/core/ras.c\",\"drivers/cxl/core/trace.h\",\"drivers/cxl/cxl.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6fc1919a6f2ed541484dd1f6cd93374044f8fd3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c268f949e219f9e179558e836f457f6c5fbec416\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc5eb0962a5e50d64e711817cc24d67df2d90528\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T05:58:36+00:00",
      "cve": "CVE-2026-80662",
      "id": "CVE-2026-80662",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80662.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:10:09Z",
      "cve": "CVE-2026-80662",
      "id": "CVE-2026-80662",
      "initial_release_date": "2026-08-28T16:34:53Z",
      "product_status:known_affected": "114",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80662",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80662.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.