Description

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512, eight times the actual on-device size. header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE (512) bytes from its source. For the CPER caller the source is struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs. Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it, bringing all iomap readers into agreement on 16 dwords. Userspace tools such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) header_log layout in the cxl_aer_uncorrectable_error trace event. Add CXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event __array and its memcpy to preserve that ABI. Both callers now pass a zero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only the first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware; the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring buffer layout intact. [ dj: Replaced 64 with SZ_64 per RichardC ]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-28T08:16:51.397Z",
  "pubdate": "2026-08-28T08:16:51.397Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) memory read vulnerability within the Linux kernel's CXL (Compute Express Link) subsystem.\nThe flaw stems from an incorrect definition of the CXL_HEADERLOG_SIZE constant, which significantly exceeded the hardware specification defined in CXL r4.0 8.2.4.17.7.\nThe vulnerability allows for the leakage of sensitive kernel stack memory into the tracefs-accessible trace event ring buffer.\nImpact includes information disclosure, where an attacker with the ability to trigger CXL error events or read trace event logs could capture sensitive kernel data.\nThe issue affects systems utilizing the CXL RAS (Reliability, Availability, and Serviceability) capability features.\nExploitation does not require network access but depends on the capability to access trace event logs or manipulate hardware error conditions that trigger the vulnerable trace event.",
  "technicalDetails": "The root cause of the vulnerability is a mismatch between the defined CXL_HEADERLOG_SIZE and the actual architectural specification for the CXL RAS Capability Structure. While the CXL r4.0 specification dictates that the Header Log occupies 64 bytes starting at offset 0x18 of a 0x58-byte structure, the kernel defined CXL_HEADERLOG_SIZE as 512 bytes.\nThis discrepancy leads to two primary exploitation vectors: direct memory access and trace event data leakage.\nFirst, the function header_log_copy() attempts to read 128 dwords (CXL_HEADERLOG_SIZE_U32) from the RAS capability I/O mapping. Because the actual mapping is only 88 bytes, this operation results in an out-of-bounds read of 448 bytes past the allocated memory region.\nSecond, the cxl_aer_uncorrectable_error trace event utilizes the inflated CXL_HEADERLOG_SIZE constant within a memcpy operation. Specifically, when the trace event is invoked by the CPER (Common Platform Error Record) handler, it copies data from a stack-allocated buffer (cxl_cper_prot_err_work_data) into the trace event ring buffer. Because the source buffer only contains 64 bytes of valid header log data, the memcpy operation reads an additional 448 bytes of adjacent kernel stack memory.\nThis sensitive stack data is subsequently written to the trace event ring buffer. In environments where tracefs is accessible to unprivileged users, or where logs are aggregated for system analysis, this allows unauthorized parties to inspect the kernel stack for potential secrets, pointers, or memory layouts, significantly aiding in bypassing KASLR or extracting sensitive cryptographic material.\nThe mitigation strategy requires decoupling the hardware-level register size from the legacy trace ABI. By introducing CXL_HEADERLOG_TRACE_SIZE_U32 (128) specifically for trace events while restricting hardware I/O operations to the correct 64-byte limit (16 dwords), the patch ensures that the ring buffer format remains consistent for userspace consumers like rasdaemon, while simultaneously preventing kernel stack memory corruption and information disclosure.\nThe fix enforces zero-padding for the remaining 112 dwords in the trace event, ensuring the 512-byte ABI size requirement is met without reading past the legitimate source buffer boundary on the kernel stack."
}