Executive brief
The Linux kernel's CXL (Compute Express Link) test module contains a code ordering issue in the setup_xor_mapping() function that triggers a Fortify buffer overflow assertion. This is a false positive in buffer boundary checking caused by an uninitialized variable being referenced before assignment, but it can cause test module loading to fail on systems with Fortify hardening enabled.
Technical details
This is a false-positive buffer overflow detected by Fortify source (kernel-level bounds checking). In setup_xor_mapping(), the code was performing a memcpy() that referenced the nr_maps field before it was initialized in a structure annotated with __counted_by(nr_maps). The Fortify checker saw this as a potential overflow because the bound (nr_maps) was still 0 at the time of the copy. The fix reorders the initialization to set cximsd->nr_maps before the memcpy, eliminating the false positive. The vulnerability is cosmetic (a code ordering issue) rather than a real exploitable buffer overflow. The fix is a one-line reorder that sets the counter field before using it.
Affected products
- Linux Linux kernel 5.x through 7.x (as of fix date)
Timeline
- 2026-08-28: disclosed
- 2026-05-19: patched: Fix authored; merged into mainline and stable trees by June 2026