Executive brief
The Linux kernel's CXL (Compute Express Link) memory controller driver contains a denial-of-service vulnerability in its poison list scanning mechanism. A misbehaving or malicious CXL device can cause the kernel to enter an infinite loop while holding a mutex, hanging the system's poison scanning thread and blocking all subsequent poison operations on the device.
Technical details
The vulnerability exists in the CXL mailbox command handler for GET_POISON_LIST (drivers/cxl/core/mbox.c). A device that returns a count==0 payload while setting the CXL_POISON_FLAG_MORE flag on every iteration causes the do/while loop to never advance the nr_records counter, preventing the max_errors guard from triggering and causing an infinite loop while holding poison.mutex. The existing protection against an uncleared _FLAG_MORE flag does not cover the empty payload case. The fix adds an early break condition when count==0 is detected, preventing malicious or faulty devices from wedging the poison scan. Attack vector is local/adjacent and requires CXL device-level control or manipulation.
Affected products
- Linux Linux kernel Multiple kernel versions (affects CXL poison list handling across versions 4.19+)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-07-09: patched: Fix committed upstream (commit 8b301c4afbce4bc3f94528441d8d5ce1366504ad) and backported to stable trees