Executive brief
The Linux kernel's CXL (Compute Express Link) memory region driver contains a use-after-free vulnerability in its error handling path. When the driver encounters an error during region setup, it releases a reference to a memory decoder before logging diagnostic information about it, potentially causing a kernel crash if that decoder is freed while still being accessed. This affects systems using CXL memory expansion hardware.
Technical details
The vulnerability is a use-after-free in the find_pos_and_ways() function within drivers/cxl/core/region.c. The error path calls put_device(dev) before logging an error message that dereferences the decoder device name via dev_name(). If the released reference is the last one, the device structure is freed while the error log still attempts to access its name field, causing a kernel panic. The fix simply reorders the code to defer the put_device() call until after the error logging is complete. This is a memory safety issue triggered during error conditions in CXL region configuration.
Affected products
- Linux Linux kernel versions with CXL support (approximately 5.13+)
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched