CVE-2026-80662

A flaw was found in the Linux kernel's Compute Express Link (CXL) subsystem. An incorrect definition of the CXL_HEADERLOG_SIZE led to an out-of-bounds read when processing RAS capability structures. This vulnerability allows a local attacker to read sensitive kernel stack memory, potentially leading to information disclosure.

A moderate information-disclosure flaw was found in the Linux kernel Compute Express Link (CXL) subsystem. The CXL_HEADERLOG_SIZE constant was defined as 512 bytes, eight times the actual 64-byte Header Log within the 88-byte CXL RAS Capability Structure. When a CXL RAS or firmware-first CPER error was handled, header_log_copy() read 128 dwords from the 88-byte RAS capability iomap, overrunning it by 448 bytes, and the cxl_aer_uncorrectable_error trace event copied 512 bytes from a 64-byte header_log array embedded in a stack-local structure. As a result, up to 448 bytes of kernel stack memory were copied into the trace event ring buffer, where they could be read by a local user with access to tracefs, leading to disclosure of kernel stack contents. No Red Hat products are affected by this flaw: all Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are currently marked NOTAFFECTED because the vulnerable code is not present in the shipped kernel packages. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5), lower than the Important severity (CVSS 3.1 score 7.1) in the upstream CVE record; the lower rating reflects that exploitation requires local access together with a CXL RAS or CPER error event and access to trace data, and exposes only limited kernel stack data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.