CVE-2026-80640 cxl/fwctl: Fix __fortify_panic
A local attacker can trigger a kernel panic via a false positive buffer overflow check in the CXL firmware control driver, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80640?
CVE-2026-80640 is a vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cxl/fwctl: Fix __fortify_panic
Fix a runtime assertion in cxlctl_get_supported_features(). Fortify complains that it is potentially overflowing the entries array per __counted_by_le(num_entries). Quiet the false positive by initializing @num_entries earlier.
memcpy: detected buffer overflow: 48 byte write of buffer size 0 WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#7: fwctl/1398 RIP: 0010:__fortify_report+0x50/0xa0 Call Trace: __fortify_panic+0xd/0xf cxlctl_get_supported_features.cold+0x23/0x35 [cxl_core]
Which versions are affected by CVE-2026-80640?
How do I fix CVE-2026-80640?
Apply the vendor's patch.
Is CVE-2026-80640 being exploited?
There is no known exploitation of CVE-2026-80640 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80640, DEBIAN-CVE-2026-80640, GHSA-88hh-78xv-cjqw, UBUNTU-CVE-2026-80640.