Linux kernel CXL core: use-after-free of the parent port during endpoint detach

Impact

cxl_detach_ep walks the port hierarchy during bottom-up removal and touches parent_port in two places where it may already be freed: once when a concurrent detach has processed the port first, and once after delete_switch_port cascades into unregistering the parent itself. With lock debugging on this is a mutex warning; on a production kernel it is a silent write to freed memory in the device-teardown path. On nodes that use CXL memory expansion to feed large-model workloads, a host panic or quiet corruption during memory-device removal costs the full job on that node. The fix establishes a lifetime rule - a child port now holds a reference to its parent.

Who can reach it

Local and privileged. Reaching it requires driving CXL port teardown: removing a CXL memory device, a hotplug event, or reloading cxl_acpi - the reporter reproduces it with a module reload in QEMU. Not reachable from a tenant pod or over the network.

What to do

Pick up a stable kernel with the listed commits (fixes landed across five branches). The change is in cxl_core and the bug lives in teardown, so a module reload is itself the dangerous path - drain the node and reboot onto the fixed kernel. Until then avoid cxl module reloads and CXL device hot-removal on production nodes.

References

Related entries

• Linux kernel blk-cgroup: use-after-free on cgroup writeback release when the last blkcg reference dropsCVE-2026-31586 · Linux kernel blk-cgroup (cgwb_release_workfn / blkcg_unpin_online)High
• Linux kernel mm/filemap: nr_pages overflow in fault-around maps past the end of a large folioCVE-2026-31648 · Linux kernel mm/filemap (nr_pages overflow in filemap_map_pages)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-31656 · Linux i915 GPU kernel driverHigh
• Linux kernel FUSE: a malicious server overflows the readdir cache page by 24 bytesCVE-2026-31694 · Linux kernel FUSE readdir cache (fuse_add_dirent_to_cache)High
• Linux kernel xen/privcmd: partial munmap of a privcmd mapping leads to a double free (XSA-487)CVE-2026-31787 · Linux kernel Xen privcmd driver (VMA splitting on hypercall mappings)High
• uutils coreutils: chroot --userspec resolves the user inside the new root, loading attacker NSS modules as rootCVE-2026-35368 · uutils coreutils `chroot --userspec` (NSS module load after chroot)High