Linux kernel CXL core: use-after-free on the parent port when a memdev is detached

CVSS 4.7CVE-2023-52771Kernel, userspace & hypervisorcurated

Impact

When a CXL memdev or any ancestor port is removed, delete_endpoint() locks the endpoint's parent without holding a reference to it, so the parent can be freed first - the reported trace is a bad-spinlock-magic splat in __mutex_lock() from the cxl_port detach_memdev worker, a use-after-free on freed device memory. A second bug picks the wrong parent device on RCH topologies. For operators running CXL memory expanders or pooled memory behind GPU nodes, this is a host crash on memory hot-remove, which is the one operation CXL pooling exists to perform; it is triggered by topology teardown rather than by tenant activity, so the exposure is to the operator's own maintenance workflow, not to an attacker.

Who can reach it

Local and administrative: requires CXL hardware with the cxl_port/cxl_mem drivers bound and a memdev or port removal (hot-remove, driver unbind). Not reachable by an unprivileged tenant and not reachable on hosts without CXL devices.

What to do

Patch the kernel to a stable release containing the linked commits, which take a reference on the parent and use endpoint->dev.parent for RCH topologies, then reboot each node. Until then, avoid CXL memdev and port hot-remove on production hosts. The record lists stable commits with no named fixed release.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-52771 https://git.kernel.org/stable/c/37179fcc916bce8c3cc7b36d67ef814cce55142b https://git.kernel.org/stable/c/de0c4ff2fcaec149254b32f18b3ec806b312be74

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.