Linux kernel cxl/port: use-after-free when CXL region decoders are torn down out of order

Impact

Tearing down a CXL region whose endpoint decoders share a switch decoder could hit the driver's in-order reset check, abort region cleanup, and leave the region referencing an already-deleted decoder object. The second teardown attempt then dereferences freed memory - the report shows a general protection fault on a poisoned pointer in to_cxl_port(). The CXL specification places no in-order requirement on switch decoder shutdown, so the fix removes decoders unconditionally. This matters where CXL memory expansion sits behind accelerators as capacity or tiering for large-model work: a region teardown that panics the host takes every job on the node with it, and CXL region lifecycle changes are exactly what happens during a memory reconfiguration or device replacement.

Who can reach it

Local and privileged - driving CXL region creation and decoder teardown requires root on the host (sysfs CXL region management, or module unbind). It is not reachable from a tenant workload, and nodes with no CXL devices are unaffected.

What to do

Take the stable kernel fix (four listed commits) via your distribution kernel and reboot each affected node; this is driver code, so a reboot is needed rather than a service restart. Until then, avoid CXL region teardown on production nodes - do memory reconfiguration with the node already out of service, which is the honest answer because that is where the crash is triggered anyway.

References

Related entries

• Linux kernel sunrpc: use-after-free when a network namespace is destroyed with an NFS TCP socket still armedCVE-2024-53168 · Linux kernel sunrpc (NFS client TCP socket lifetime vs. network namespace teardown)High
• Linux kernel (drivers/vfio/pci): Out-of-bounds read past the ecap_perms table when a tenant touches emulated PCIeCVE-2024-53214 · Linux kernel (drivers/vfio/pci)High
• Linux kernel nfsd: use-after-free and RCU-context sleep when reading the export cacheCVE-2024-53216 · Linux kernel nfsd/sunrpc (svc_export and svc_expkey cache teardown)High
• Linux kernel (drivers/gpu/drm/xe): A tenant that suspends an exec queue and then closes it while the GuCCVE-2024-56552 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/iommu/iommufd): An error path releases the iommufd fault object and the iommufd context twiceCVE-2024-56624 · Linux kernel (drivers/iommu/iommufd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2024-56695 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High