Executive brief
The Linux kernel's Compute Express Link (CXL) firmware control module contains a buffer overflow detection false positive in the cxlctl_get_supported_features() function. While not an exploitable security vulnerability, the Fortify buffer protection mechanism was incorrectly flagging a potential overflow, causing runtime warnings. The fix ensures the array bounds are properly initialized before use, eliminating the false positive warning.
Technical details
This is a buffer overflow detection false positive in the CXL firmware control (fwctl) subsystem. The vulnerability class is a Fortify/compile-time protection mechanism triggering incorrectly—specifically, the __counted_by_le(num_entries) annotation was not satisfied because num_entries was initialized after the memcpy operation rather than before it. The root cause is an initialization ordering issue in the cxlctl_get_supported_features() function within drivers/cxl/core/features.c. The fix moves the initialization of feat_out->num_entries earlier in the function (before the memcpy loop) to satisfy the array bounds annotation. This is a defensive programming fix rather than a security patch addressing actual exploitability—no attack vector or external trigger is required, as this affects only kernel-internal CXL feature command processing.
Affected products
- Linux Linux kernel multiple versions (see git.kernel.org for full affected range)
Timeline
- 2026-08-28: disclosed: CVE-2026-80640 published
- 2026-05-19: patched: Upstream patch by Dan Williams committed
- 2026-07-24: patched: Patch included in stable release