Executive brief
The Linux kernel's CXL (Compute Express Link) subsystem incorrectly defined the size of a hardware capability structure's header log, causing it to read and expose sensitive kernel memory to userspace via trace events. This could allow local users to leak kernel stack contents and potentially sensitive information, compromising system security and data privacy.
Technical details
The vulnerability is a buffer over-read in the CXL RAS (Reliability, Availability, and Serviceability) Capability handling code. The CXL_HEADERLOG_SIZE was incorrectly set to 512 bytes instead of the actual hardware size of 64 bytes. When header_log_copy() reads from the RAS capability iomap and when the cxl_aer_uncorrectable_error trace event memcpys data, it reads 448 bytes beyond the valid mapping region. For CPER (UEFI Common Platform Error Record) callers, the source is a 64-byte header_log field embedded in stack-local memory, allowing kernel stack data to be written to the trace event ring buffer and exposed to userspace via tracefs. The fix corrects CXL_HEADERLOG_SIZE to 64 bytes and uses a zero-padded staging buffer for the trace event to maintain userspace ABI compatibility.
Affected products
- Linux kernel affected versions prior to patch
Timeline
- 2026-08-28: disclosed