Out-of-bounds read in Linux kernel - CVE-2026-80662
Published: August 28, 2026
Vulnerability identifier: #VU146138
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80662
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the cxl RAS header log handling and trace event path when processing CXL RAS error data. A local user can trigger CXL error handling to copy kernel stack data into the trace event ring buffer and disclose sensitive information.
Userspace can read the exposed trace event data via tracefs.
Affected software
Linux kernel
How to mitigate CVE-2026-80662
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3