CVE-2026-80640

A flaw was found in the Linux kernel's CXL subsystem firmware control (cxl/fwctl). A buffer overflow vulnerability exists in the cxlctl_get_supported_features() function due to improper initialization of an array size. This could lead to a system crash, resulting in a denial of service (DoS).

A flaw of low impact was found in the Linux kernel CXL firmware control (cxl/fwctl) subsystem of Red Hat Enterprise Linux 10. In cxlctl_get_supported_features(), the num_entries variable that annotates the entries array via __counted_by_le() is initialized only after the array begins to be filled, so the kernel's FORTIFY runtime check treats the destination buffer as zero-length and reports a 48-byte write into a 0-byte buffer, resulting in __fortify_panic and a system crash (denial of service). Triggering this condition requires local access to a system with CXL fwctl support. Only Red Hat Enterprise Linux 10 streams (rhel-10.2.z, rhel-10.3, rhel-10.4) are affected; earlier RHEL releases and Red Hat In-Vehicle OS are not affected because the CXL fwctl RPC command support that introduced this code is not present in those products. The fix is deferred for the affected RHEL 10 streams because the issue is a low-impact FORTIFY-reported runtime assertion rather than a demonstrated out-of-bounds write, and the residual risk is limited to a local kernel panic on systems with CXL hardware. Red Hat assesses this flaw as low severity, lower than the moderate CVSS:3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) would suggest, because exploitation requires local access with CXL hardware present and the impact is limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.