Linux kernel (drivers/pci/pcie): The ASPM link state of a PCIe switch is freed as soon as ANY function on the upstream

CVSS 6.5CVE-2024-58093Kernel, userspace & hypervisorcurated

Impact

The ASPM link state of a PCIe switch is freed as soon as ANY function on the upstream port is removed, while downstream ports still hold it as their parent link. Every subsequent reference is a use-after-free, and the reported symptom is a general protection fault that takes the whole node down - all tenants on it, not just the one whose device went away.

Who can reach it

Triggered by device removal under a multi-function PCIe switch upstream port, which is exactly the topology in a GPU box where a Broadcom/PLX switch fans out to eight accelerators or a bank of NVMe. The upstream note says the faults are ESPECIALLY frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order and therefore hits the non-zero function before function 0. No tenant credentials are needed - a surprise removal, a device that drops off the link, or a maintenance pull supplies the event. Requires ASPM enabled and a switch with a multi-function upstream port.

What to do

Update to 5.4.292 / 5.10.236 / 5.15.180 / 6.1.134 / 6.4 / 6.5 or later. Interim: drain the node before any planned PCIe removal under a switch, and consider disabling ASPM (pcie_aspm=off) on nodes where hot-removal under a switch is routine.

References

https://git.kernel.org/stable/c/0a0f9aecf66b98959aab7fb5764b4b3e522f4f5b https://git.kernel.org/stable/c/62db339ecc3d58d8fd83a9e4d80061cd943bb6e2 https://nvd.nist.gov/vuln/detail/CVE-2024-58093

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.