cxl/port: Fix use after free of parent_port in cxl_detach_ep()
In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by calling delete_switch_port(). There are two places during this work where the parent_port may be used after freeing: First, a concurrent detach may have already processed a port by the time a second worker finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory corruption, with lock debug, it looks like this: []DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace: []mutex_unlock+0xd/0x20 []cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20 []devres_release_all+0xa8/0xe0 []device_unbind_cleanup+0xd/0xa0 []really_probe+0x1a6/0x3e0 Second, delete_switch_port() releases three devm actions registered against parent_port. The last of those is unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is now also empty the device core may unregister and free it too. So by the time
CVE-2026-31530
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31530
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5",
"lessThan": "b1f62588ab1be6c9535d74348003c86b47ec4abd",
"versionType": "git"
},
{
"status": "affected",
"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5",
"lessThan": "d216a4bd138eb57cc4ae7c43b2f709e3482af7e2",
"versionType": "git"
},
{
"status": "affected",
"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5",
"lessThan": "2c32141462045cf93d54a5146a0ba572b83533dd",
"versionType": "git"
},
{
"status": "affected",
"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5",
"lessThan": "f7dc6f381a1e5f068333f1faa9265d6af1df4235",
"versionType": "git"
},
{
"status": "affected",
"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5",
"lessThan": "19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4",
"versionType": "git"
}
],
"programFiles": [
"drivers/cxl/core/port.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/cxl/core/port.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31530
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46133 · Revision 1
- Added to Heist Feed
- Publisher date