Executive brief
A vulnerability in the Linux kernel's firmware control (fwctl) framework can cause a system crash when certain hardware devices are removed. This occurs because the system attempts to access memory that hasn't been properly set up during the initial startup process. While this primarily affects system stability, it could lead to a denial-of-service if triggered.
Technical details
A race condition or initialization ordering issue exists in the Linux kernel where the CXL driver is initialized before the fwctl framework. When cxl_pci_probe() calls fwctl_register() and device_add(), the fwctl_class may not yet be registered, causing class_to_subsys() to return NULL and skip knode_class initialization. Consequently, during device removal, device_del() calls klist_del() on an uninitialized knode, resulting in a NULL pointer dereference and kernel panic. The fix involves changing the fwctl initialization from module_init() to subsys_initcall() to ensure it is available before dependent drivers.
Affected products
- Linux Linux 6.15 to 6.18.33, 7.0.10
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory