Linux kernel CXL fwctl: supported-features query trips a fortify panic and takes the host down

Impact

cxlctl_get_supported_features() fills the entries array before setting num_entries, so with CONFIG_FORTIFY_SOURCE the __counted_by_le bound is still zero when the 48-byte memcpy runs and the kernel takes __fortify_panic - an unconditional BUG, not a returned error. The result is that a routine feature enumeration against a CXL device through the fwctl character device panics the whole host instead of failing the ioctl. On a GPU node with CXL memory expanders that is an unscheduled outage for every tenant on the box, and the jobs in flight are lost rather than drained. No memory corruption and no privilege boundary is crossed: this is availability only, and it is reachable only by whoever already holds the fwctl device.

Who can reach it

Local and privileged. Requires access to the CXL fwctl device node (normally root / CAP_SYS_RAWIO, i.e. host management tooling or a firmware-inventory agent). Not reachable from an unprivileged tenant pod, from a GPU container, or over the network.

What to do

Take the stable kernel carrying the fix that initialises num_entries before the copy (commits 18c67ecc5daf, 6c9d2e87df40, b8d15e85596a). There is no live-patch path for this - each host needs a kernel update and a reboot, so fold it into the next node-drain window. Until then, keep fwctl device access restricted to trusted management tooling and hold off on CXL feature-enumeration sweeps across the fleet. No vendor advisory beyond the kernel commits is present in the record.

References

Related entries

• Linux ccp/SEV: zero-length cert chain in PDH export hits a BUG_ON on CONFIG_DEBUG_VIRTUAL kernelsCVE-2026-80652 · Linux kernel crypto/ccp AMD PSP driver (SEV PDH export ioctl)Unscored
• Linux BPF LSM: attaching to xfrm_decode_session turns packet classification into a kernel panicCVE-2026-80669 · Linux kernel BPF LSM (xfrm_decode_session hook attachment)Unscored
• Linux kernel migrate_device: pte_pfn/pte_dirty called on non-present PTEs during device migrationCVE-2026-80686 · Linux kernel mm/migrate_device (migrate_vma_collect_pmd non-present PTE handling)Unscored
• Linux iommufd: vDEVICE alloc error path leaks the igroup mutex and deadlocks later vDEVICE operationsCVE-2026-80687 · Linux kernel iommufd/viommu (vDEVICE alloc ioctl igroup lock)Unscored
• Linux kernel idxd: double free of wq, engine and group structs on setup error and cleanup pathsCVE-2026-80698 · Linux kernel dmaengine idxd (Intel DSA/IAA wq, engine and group device setup)Unscored
• Linux kernel KVM arm64 vGIC: double-deactivate of nested IRQs trips an AmpereOne erratumCVE-2026-80699 · Linux kernel KVM/arm64 vGIC (nested-context IRQ deactivation)Unscored