Linux kernel CXL: oversized header-log size overruns the RAS iomap and leaks kernel stack via tracefs

Impact

CXL_HEADERLOG_SIZE was defined eight times larger than the RAS Capability Structure's actual 64-byte header log. header_log_copy() therefore reads 128 dwords from an 88-byte MMIO mapping, running 448 bytes past the end of the iomap, and the cxl_aer_uncorrectable_error trace event memcpy()s 512 bytes from a 64-byte stack-embedded source in the CPER path. Those 448 bytes of adjacent kernel stack land in the trace ring buffer, where anyone with tracefs read access can retrieve them - useful material for defeating KASLR or lifting whatever transiently sat on that stack. This only fires on hosts with CXL devices that report RAS errors, which is an increasingly common shape for GPU nodes using CXL memory expansion, and the disclosure happens without the attacker needing to cause the error themselves.

Who can reach it

Local user with read access to tracefs (root or a monitoring/tracing group) on a host with CXL devices, once a CXL uncorrectable-error event has been recorded. The out-of-bounds MMIO read happens in kernel context on error handling, not on demand from an attacker.

What to do

Apply the fixed stable kernel from the linked commits and reboot affected CXL hosts; the fix changes a compile-time constant and the trace event staging buffers, so nothing short of a new kernel helps. As an interim measure, restrict tracefs to root and avoid handing trace-read access to tenant-facing monitoring agents on CXL-equipped nodes. No fixed release number is stated in the record beyond the stable commits.

References

Related entries

• Linux kernel KVM arm64 NV: unresolvable VNCR translation crashes the host instead of injecting an abortCVE-2026-80665 · Linux kernel KVM/arm64 nested virtualization (kvm_translate_vncr VNCR abort path)High
• Linux kernel mm: snapshot_page() reads a non-existent tail page for order-1 folios and oopses the hostCVE-2026-80685 · Linux kernel mm/util snapshot_page() (order-1 folio tail-page read)High
• Linux kernel cxl/ras: RCH AER capability copy reads past the mapped register blockCVE-2026-89731 · Linux kernel CXL RAS (cxl_rch_get_aer_info, RCRB AER register copy)High
• KVM arm64 vgic-its: guest MAPC with V=0 crashes the host when the VMM saves ITS tablesCVE-2026-89912 · Linux kernel KVM arm64 vgic-its (ITT save path)High
• KVM x86 Hyper-V stimer: overflowed deadline livelocks the vCPU thread and stalls RCU on the hostCVE-2026-89927 · Linux kernel KVM x86 Hyper-V synthetic timer (stimer deadline calculation)High
• KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksCVE-2021-22543 · KVMHigh