Executive brief
The Linux kernel's CXL (Compute Express Link) subsystem contains a buffer overread vulnerability in AER (Advanced Error Reporting) register access. When reading PCIe error information from CXL devices, the code reads beyond the physical register boundaries, potentially exposing kernel memory and causing subsequent out-of-bounds reads when processing error logs. This can lead to information disclosure or kernel crashes on systems with CXL-capable hardware.
Technical details
The vulnerability exists in cxl_rch_get_aer_info() in drivers/cxl/core/ras_rch.c, which copies AER capability registers from MMIO using a loop bounded by sizeof(struct aer_capability_regs). However, the software struct is larger than the actual on-wire AER capability definition, causing the readl() loop to read past the mapped register block. The over-read populates software-only tail fields including header_log.header_len with uninitialized MMIO data; an out-of-range header_len then causes pcie_print_tlp_log() to loop past the header log buffer, triggering a second out-of-bounds read. The root cause is struct pcie_tlp_log growing over time while the read bounds were never updated. The fix bounds the read to PCI_ERR_HEADER_LOG + 16 bytes and zeroes the destination buffer first, ensuring software-only fields remain deterministic.
Affected products
- Linux Linux kernel 5.0 through 7.2 (and backported stable kernels)
Timeline
- 2026-09-11: disclosed: Published to NVD
- 2026-08-05: patched: Patch committed upstream by Dave Jiang
- 2026-09-21: patched: Patch backported to stable kernels by Greg Kroah-Hartman