{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26762", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.172Z", "datePublished": "2024-04-03T17:00:45.655Z", "dateUpdated": "2026-08-05T11:27:04.300Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:04.300Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\n\nThe PCI AER model is an awkward fit for CXL error handling. While the\nexpectation is that a PCI device can escalate to link reset to recover\nfrom an AER event, the same reset on CXL amounts to a surprise memory\nhotplug of massive amounts of memory.\n\nAt present, the CXL error handler attempts some optimistic error\nhandling to unbind the device from the cxl_mem driver after reaping some\nRAS register values. This results in a \"hopeful\" attempt to unplug the\nmemory, but there is no guarantee that will succeed.\n\nA subsequent AER notification after the memdev unbind event can no\nlonger assume the registers are mapped. Check for memdev bind before\nreaping status register values to avoid crashes of the form:\n\n BUG: unable to handle page fault for address: ffa00000195e9100\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n [...]\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\n [...]\n Call Trace:\n \n ? __die+0x24/0x70\n ? page_fault_oops+0x82/0x160\n ? kernelmode_fixup_or_oops+0x84/0x110\n ? exc_page_fault+0x113/0x170\n ? asm_exc_page_fault+0x26/0x30\n ? __pfx_dpc_reset_link+0x10/0x10\n ? __cxl_handle_ras+0x30/0x110 [cxl_core]\n ? find_cxl_port+0x59/0x80 [cxl_core]\n cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\n cxl_error_detected+0x6c/0xf0 [cxl_core]\n report_error_detected+0xc7/0x1c0\n pci_walk_bus+0x73/0x90\n pcie_do_recovery+0x23f/0x330\n\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\nneed to be replaced with a new PCI_ERS_RESULT_PANIC." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is only reachable through the local PCIe AER/DPC error-reporting path (`pcie_do_recovery()` → `report_error_detected()` → `cxl_error_detected()`) on a CXL-attached host; there is no network- or peer-supplied data involved. Local access to the machine hosting the CXL memory device is the applicable vector, and it is the higher-severity of the two candidate vectors (Local vs. Physical device manipulation).\nAC:L - The vulnerable state is entered deterministically — the kernel's own handler calls `device_release_driver()` on the first uncorrectable/frozen event, unmapping the devm-owned RAS/AER blocks — and any following AER notification unconditionally dereferences the stale `dport->regs.ras`. The sequence is repeatable at will on affected hardware with no condition outside the attacker's influence.\nPR:L - No privilege is needed to enter the vulnerable state: the memdev unbind that invalidates the mappings is performed by the kernel error handler itself, not by an administrator. CXL Type-3 media is surfaced as an ordinary System-RAM NUMA node that any unprivileged local user can allocate from and drive CXL.mem RAS reporting against, so basic local user access suffices to keep error notifications flowing into the stale-pointer path.\nUI:N - No victim action is required; PCIe AER/DPC notifications are consumed automatically by the kernel recovery worker, which invokes `cxl_error_detected()`/`cxl_cor_error_detected()` without any user involvement.\nS:U - The stale `__iomem` dereference, disclosure, and corruption all occur inside the kernel's own security authority in the CXL core driver, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `dport->regs.ras`/`dport->regs.dport_aer` dangle into the shared vmalloc/ioremap address space after `devm_iounmap()`, and `header_log_copy()` reads 512 bytes from that address into the `cxl_aer_uncorrectable_error` trace event; once the range is recycled by another `ioremap()`/`vmalloc()` this leaks foreign device registers or kernel memory, a use-after-unmap read primitive.\nI:H - `__cxl_handle_ras()` and `__cxl_handle_cor_ras()` perform `writel()` through the same dangling mapping, storing a status value back at a fixed offset; after the VA is reclaimed this corrupts whatever now occupies it — another device's MMIO window or a recycled vmalloc allocation — giving a groomable write primitive alongside the read.\nA:H - The documented and near-certain outcome is an immediate kernel page fault on a not-present page inside `__cxl_handle_ras()` running in the AER recovery path, producing an oops (panic with `panic_on_oops`) and taking down a host whose main memory is the CXL device being torn down." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/cxl/core/pci.c" ], "versions": [ { "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab", "lessThan": "21e5e84f3f63fdf44e49642a6e45cd895e921a84", "status": "affected", "versionType": "git" }, { "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab", "lessThan": "eef5c7b28dbecd6b141987a96db6c54e49828102", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/cxl/core/pci.c" ], "versions": [ { "version": "6.7", "status": "affected" }, { "version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.7", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.7.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84" }, { "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102" } ], "title": "cxl/pci: Skip to handle RAS errors if CXL.mem device is detached", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26762", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-04-05T18:38:38.263308Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:18.559Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.382Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102", "tags": [ "x_transferred" ] } ] } ] } }