Executive brief
The Linux kernel's CXL (Compute Express Link) region auto-discovery mechanism can leave NULL pointer "holes" in target arrays when endpoint decoders are removed, leading to crashes during region attachment. This affects storage and memory expansion systems using CXL interconnects and can cause system instability or data access failures when regions are being dynamically assembled or reconfigured.
Technical details
This is a NULL pointer dereference and logic error in the cxl/region auto-assembly code. The vulnerability occurs because cxl_region_attach_auto() appends new endpoint decoders to the end of the target array without filling NULL holes left by previous decoder removals. When a decoder is removed via cxl_cancel_auto_attach() or region detachment, if it is not the last array element, a NULL hole remains. The kernel's cxl_calc_interleave_pos() function then dereferences these NULL pointers, causing a general protection fault (GPF). Additionally, the driver incorrectly counts NULL pointers when validating whether enough decoders are attached (using p->nr_targets), allowing incomplete regions to be marked as valid. The fix adjusts the attachment logic to locate and fill the first free (NULL) slot in the target array instead of always appending. The vulnerability is a kernel bug introduced by incorrect auto-assembly logic, not a user-exploitable flaw.
Affected products
- Linux Linux kernel prior to fix commit
Timeline
- 2026-08-15: disclosed