The Linux kernel contains an out-of-bounds read vulnerability in the CXL subsystem that could allow a local attacker with low privileges to leak sensitive kernel stack information.

The vulnerability stems from an incorrectly defined buffer size (CXL_HEADERLOG_SIZE) within the CXL RAS Capability structure. This causes memory copy operations to read beyond the intended 64 bytes, resulting in the leakage of kernel stack data into the trace event ring buffer where it can be accessed by local users.

The ability for a local, low-privileged user to read kernel stack memory poses a significant risk to system confidentiality. By accessing this memory, an attacker may extract sensitive information such as cryptographic keys, credentials, or pointers that could facilitate further exploitation, such as bypassing kernel-level protections. Given the CVSS score of 7.1, this vulnerability is classified as high severity, particularly in multi-tenant environments or systems where local user isolation is critical.

Immediate Action: Update the Linux kernel to version 6.18.42, 7.1.5, or later, as these versions contain the corrected buffer size definitions.

Proactive Monitoring: Monitor system audit logs and tracefs access patterns for unusual activity or attempts by unauthorized users to inspect kernel trace events.

Compensating Controls: Restrict access to tracefs and sensitive kernel debugging interfaces to only highly privileged administrative accounts to limit the exposure of the vulnerability.

Public Exploit Available: No — exploit_available (unknown)

This vulnerability represents a serious risk to kernel-level data integrity and confidentiality. Administrators should prioritize patching affected Linux distributions as part of their standard maintenance cycle to prevent local information disclosure. Applying the provided kernel updates is the only definitive way to resolve the buffer over-read issue.