A mismatch between the defined header log size in the CXL RAS capability structure and the actual hardware size causes the kernel to copy 512 bytes of data from the CXL header log instead of the intended 64 bytes. This results in a buffer overrun that reads beyond the mapped 88‑byte region, spilling kernel stack contents into the CXL_AER trace event. Userspace applications that read this event through tracefs can therefore obtain kernel memory that was not intended to be exposed, creating a potential information‑disclosure risk. The flaw is driven by an out‑of‑bounds read and a memcpy that overflows the ring buffer used for trace events. The likely attack vector is a local process that can trigger the erroneous memcpy by causing a CXL_AER trace event.

All Linux kernel releases that contain the pre‑patch version of the CXL driver. The vulnerability is present in the generic Linux kernel, with no vendor‑specific version constraints listed in the advisory. Administrators should verify whether their kernel build includes the older CXL_HEADERLOG_SIZE definition and apply the latest upstream fixes. It is inferred that any kernel build compiling the older CXL driver without the patch is affected.

The CVSS score is not provided, and the EPSS score is unavailable, which limits quantitative risk assessment. The vulnerability is discovered in kernel space and requires the ability to trigger the erroneous memcpy—generally available to local privileged users or processes that can generate the trace event. Since the leaked data can be accessed via tracefs, which may be readable by non‑root users on many systems, the impact may be felt by a broader set of users than just those with root. The likely attack vector is a local user with the ability to trigger the CXL_AER trace event or to read tracefs data. Though the issue does not provide direct remote code execution, the information exposure could aid a subsequent attack or privilege escalation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of this analysis.