Linux Kernel EUVD-2026-67538

Exploitation requires: (1) a local user account on the target system; (2) read access to the Linux tracefs filesystem (typically /sys/kernel/tracing, which on most distributions is restricted to the tracing group or root - not world-readable by default); (3) a vulnerable Linux kernel version beginning from Linux 6.2 (commit 2905cb5236cba63a5dc8a83752dcc31f3cc819f9) and not yet patched to 6.18.42, 7.1.5, or 7.2; (4) CXL hardware physically installed and the CXL kernel subsystem compiled and active; and (5) a CXL AER uncorrectable error event occurring - either naturally or induced. The iomap overrun availability impact occurs on the same error-handling path and does not require tracefs access, but does require CXL hardware and a triggerable AER event. Limiting factors include: local-only attack vector, non-default hardware requirement (CXL is not present in most commodity servers), tracefs access controls that restrict the disclosure vector to privileged or group-allowed users, and the need for an error event to occur on the CXL device.

The CVSS 7.1 score with AV:L/AC:L/PR:L accurately characterizes that exploitation is bounded to local access on a system with CXL hardware, substantially constraining the realistic attack surface. The EPSS score of 0.17% (6th percentile) corroborates negligible automated or opportunistic exploitation probability, consistent with the hardware dependency and local-only vector. There is no CISA KEV listing and no public exploit identified at time of analysis. The practical risk is bifurcated: the tracefs information disclosure path (C:H) is the more exploitable vector, as an attacker already present on the system could harvest kernel stack contents for KASLR bypass or recovery of sensitive in-flight data, potentially facilitating privilege escalation; the iomap overrun path represents a potential denial-of-service on error-handling code paths in production CXL environments, where a single AER event could trigger a kernel fault. Even a mid-sized data center operator running Linux on CXL-equipped servers should treat this as a routine patch-cycle item rather than an emergency, given the local-only vector, specialized hardware prerequisite, and absence of weaponized exploits or active exploitation indicators.

A local user with read access to the tracefs filesystem waits for or induces a CXL AER uncorrectable error on a server with CXL hardware. When the cxl_aer_uncorrectable_error trace event fires, the kernel memcpy's 512 bytes from a 64-byte stack-allocated source into the tracefs ring buffer, inadvertently including 448 bytes of adjacent kernel stack data. The attacker reads the ring buffer via tracefs, potentially recovering kernel code pointers to defeat KASLR or extracting sensitive stack-resident values to support further privilege escalation.