In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512, eight times the actual on-device size. header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE (512) bytes from its source. For the CPER caller the source is struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs. Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it, bringing all iomap readers into agreement
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80662 is a buffer over-read vulnerability in the Linux kernel's CXL (Compute Express Link) subsystem that occurs when reading the RAS (Reliability, Availability, and Serviceability) Capability Structure. The vulnerability stems from a mismatch between the defined CXL_HEADERLOG_SIZE constant (512 bytes) and the actual on-device header log size (64 bytes), causing the header_log_copy() function to read 128 dwords from an 88-byte mapped region. This affects Linux kernel versions with the vulnerable CXL driver code, potentially impacting systems that utilize CXL-capable hardware for memory expansion or accelerator connectivity. While this is a kernel-level issue, successful exploitation could lead to information disclosure through out-of-bounds memory reads or denial of service conditions.
Casky's platform, powered by Claude AI with extended reasoning capabilities, would detect attack patterns associated with this vulnerability through memory access anomaly detection and kernel boundary analysis mapped to MITRE ATT&CK framework techniques. Practitioners would observe findings related to T1005 (Data from Local System) if an attacker attempts to exfiltrate data from adjacent kernel memory regions, or T1499 (Endpoint Denial of Service) if the over-read causes system instability or crashes. The detection would manifest as suspicious iomap access patterns within CXL driver contexts, kernel log anomalies indicating RAS capability structure violations, and out-of-bounds access attempts that exceed the legitimate 88-byte boundary. Security teams implementing Casky would see alerts correlating kernel memory access violations with CXL subsystem interactions, enabling rapid identification and patching before exploitation occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80662. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation