Linux kernel GHES: CXL CPER work locks taken without IRQ protection can deadlock a CPU

Impact

The CXL CPER work registration helpers take cxl_cper_work_lock and cxl_cper_prot_err_work_lock with a plain spinlock guard that leaves local interrupts enabled, while the post paths take the same locks from hard IRQ context in the GHES error notification path. If a GHES interrupt lands on a CPU that already holds one of these locks, the handler spins on a lock whose holder it has preempted, and the CPU deadlocks. On PREEMPT_RT the plain spinlock is an rt_mutex and cannot be taken from hard IRQ at all. This matters on GPU nodes using CXL memory expansion: the trigger is a hardware error report, so the node hangs precisely when it is already reporting a memory problem, and recovery is a hard reboot. The same patch closes a use-after-free window where a CPER interrupt could schedule work on a pointer about to be freed during module exit.

Who can reach it

No network or tenant path - the trigger is a platform hardware error delivered through GHES while the CXL CPER registration or unregistration path holds the lock, i.e. module load/unload racing a real firmware error report. Local privileged (module) activity plus hardware error timing.

What to do

Patch the host kernel to a stable release converting both locks to raw_spinlock_t and restructuring the unregister paths (commits below), then reboot the node. Nodes without CXL memory devices or with GHES CPER for CXL unused are not exposed. The record names no vendor fixed-version string beyond the stable commits.

References

Related entries

• Linux kernel hugetlb: reservation counter underflow when a parent unmaps a shared huge page firstCVE-2026-89593 · Linux kernel hugetlb (__unmap_hugepage_range reservation accounting)Unscored
• Linux kernel efivarfs: unprivileged statfs() floods the UEFI QueryVariableInfo runtime serviceCVE-2026-89604 · Linux kernel efivarfs (statfs handler, QueryVariableInfo rate limit)Unscored
• Linux CephFS client: unchecked dentry name length overflows a NAME_MAX buffer in the NFS re-export pathCVE-2026-89652 · Linux kernel CephFS client (ceph_get_name / __get_snap_name, NFS-export path)Unscored
• Linux CephFS client: out-of-range MDS rank in mdsmap export_targets writes past a stack bitmapCVE-2026-89653 · Linux kernel CephFS client (mdsmap decode, export_targets rank validation)Unscored
• Linux CephFS client: use-after-free on an MDS session freed while check_new_map drops mdsc->mutexCVE-2026-89654 · Linux kernel CephFS client (check_new_map, MDS session refcounting)Unscored
• Linux CephFS client: use-after-free when a cap-flush entry is freed by a fast FLUSH_ACK mid-iterationCVE-2026-89655 · Linux kernel CephFS client (__kick_flushing_caps, cap flush list iteration)Unscored