CVE-2024-26762 (GCVE-0-2024-26762)
Vulnerability from cvelistv5
Published
2024-04-03 17:00
Modified
2026-08-05 11:27
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/pci: Skip to handle RAS errors if CXL.mem device is detached The PCI AER model is an awkward fit for CXL error handling. While the expectation is that a PCI device can escalate to link reset to recover from an AER event, the same reset on CXL amounts to a surprise memory hotplug of massive amounts of memory. At present, the CXL error handler attempts some optimistic error handling to unbind the device from the cxl_mem driver after reaping some RAS register values. This results in a "hopeful" attempt to unplug the memory, but there is no guarantee that will succeed. A subsequent AER notification after the memdev unbind event can no longer assume the registers are mapped. Check for memdev bind before reaping status register values to avoid crashes of the form: BUG: unable to handle page fault for address: ffa00000195e9100 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core] [...] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x160 ? kernelmode_fixup_or_oops+0x84/0x110 ? exc_page_fault+0x113/0x170 ? asm_exc_page_fault+0x26/0x30 ? __pfx_dpc_reset_link+0x10/0x10 ? __cxl_handle_ras+0x30/0x110 [cxl_core] ? find_cxl_port+0x59/0x80 [cxl_core] cxl_handle_rp_ras+0xbc/0xd0 [cxl_core] cxl_error_detected+0x6c/0xf0 [cxl_core] report_error_detected+0xc7/0x1c0 pci_walk_bus+0x73/0x90 pcie_do_recovery+0x23f/0x330 Longer term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might need to be replaced with a new PCI_ERS_RESULT_PANIC.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab
Version: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T18:38:38.263308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:18.559Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.382Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21e5e84f3f63fdf44e49642a6e45cd895e921a84",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            },
            {
              "lessThan": "eef5c7b28dbecd6b141987a96db6c54e49828102",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\n\nThe PCI AER model is an awkward fit for CXL error handling. While the\nexpectation is that a PCI device can escalate to link reset to recover\nfrom an AER event, the same reset on CXL amounts to a surprise memory\nhotplug of massive amounts of memory.\n\nAt present, the CXL error handler attempts some optimistic error\nhandling to unbind the device from the cxl_mem driver after reaping some\nRAS register values. This results in a \"hopeful\" attempt to unplug the\nmemory, but there is no guarantee that will succeed.\n\nA subsequent AER notification after the memdev unbind event can no\nlonger assume the registers are mapped. Check for memdev bind before\nreaping status register values to avoid crashes of the form:\n\n BUG: unable to handle page fault for address: ffa00000195e9100\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n [...]\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  ? __die+0x24/0x70\n  ? page_fault_oops+0x82/0x160\n  ? kernelmode_fixup_or_oops+0x84/0x110\n  ? exc_page_fault+0x113/0x170\n  ? asm_exc_page_fault+0x26/0x30\n  ? __pfx_dpc_reset_link+0x10/0x10\n  ? __cxl_handle_ras+0x30/0x110 [cxl_core]\n  ? find_cxl_port+0x59/0x80 [cxl_core]\n  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\n  cxl_error_detected+0x6c/0xf0 [cxl_core]\n  report_error_detected+0xc7/0x1c0\n  pci_walk_bus+0x73/0x90\n  pcie_do_recovery+0x23f/0x330\n\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\nneed to be replaced with a new PCI_ERS_RESULT_PANIC."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only reachable through the local PCIe AER/DPC error-reporting path (`pcie_do_recovery()` \u2192 `report_error_detected()` \u2192 `cxl_error_detected()`) on a CXL-attached host; there is no network- or peer-supplied data involved. Local access to the machine hosting the CXL memory device is the applicable vector, and it is the higher-severity of the two candidate vectors (Local vs. Physical device manipulation).\nAC:L - The vulnerable state is entered deterministically \u2014 the kernel\u0027s own handler calls `device_release_driver()` on the first uncorrectable/frozen event, unmapping the devm-owned RAS/AER blocks \u2014 and any following AER notification unconditionally dereferences the stale `dport-\u003eregs.ras`. The sequence is repeatable at will on affected hardware with no condition outside the attacker\u0027s influence.\nPR:L - No privilege is needed to enter the vulnerable state: the memdev unbind that invalidates the mappings is performed by the kernel error handler itself, not by an administrator. CXL Type-3 media is surfaced as an ordinary System-RAM NUMA node that any unprivileged local user can allocate from and drive CXL.mem RAS reporting against, so basic local user access suffices to keep error notifications flowing into the stale-pointer path.\nUI:N - No victim action is required; PCIe AER/DPC notifications are consumed automatically by the kernel recovery worker, which invokes `cxl_error_detected()`/`cxl_cor_error_detected()` without any user involvement.\nS:U - The stale `__iomem` dereference, disclosure, and corruption all occur inside the kernel\u0027s own security authority in the CXL core driver, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `dport-\u003eregs.ras`/`dport-\u003eregs.dport_aer` dangle into the shared vmalloc/ioremap address space after `devm_iounmap()`, and `header_log_copy()` reads 512 bytes from that address into the `cxl_aer_uncorrectable_error` trace event; once the range is recycled by another `ioremap()`/`vmalloc()` this leaks foreign device registers or kernel memory, a use-after-unmap read primitive.\nI:H - `__cxl_handle_ras()` and `__cxl_handle_cor_ras()` perform `writel()` through the same dangling mapping, storing a status value back at a fixed offset; after the VA is reclaimed this corrupts whatever now occupies it \u2014 another device\u0027s MMIO window or a recycled vmalloc allocation \u2014 giving a groomable write primitive alongside the read.\nA:H - The documented and near-certain outcome is an immediate kernel page fault on a not-present page inside `__cxl_handle_ras()` running in the AER recovery path, producing an oops (panic with `panic_on_oops`) and taking down a host whose main memory is the CXL device being torn down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:04.300Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
        },
        {
          "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
        }
      ],
      "title": "cxl/pci: Skip to handle RAS errors if CXL.mem device is detached",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26762",
    "datePublished": "2024-04-03T17:00:45.655Z",
    "dateReserved": "2024-02-19T14:20:24.172Z",
    "dateUpdated": "2026-08-05T11:27:04.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.382Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26762\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-05T18:38:38.263308Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:22.318Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"cxl/pci: Skip to handle RAS errors if CXL.mem device is detached\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is only reachable through the local PCIe AER/DPC error-reporting path (`pcie_do_recovery()` \\u2192 `report_error_detected()` \\u2192 `cxl_error_detected()`) on a CXL-attached host; there is no network- or peer-supplied data involved. Local access to the machine hosting the CXL memory device is the applicable vector, and it is the higher-severity of the two candidate vectors (Local vs. Physical device manipulation).\\nAC:L - The vulnerable state is entered deterministically \\u2014 the kernel\u0027s own handler calls `device_release_driver()` on the first uncorrectable/frozen event, unmapping the devm-owned RAS/AER blocks \\u2014 and any following AER notification unconditionally dereferences the stale `dport-\u003eregs.ras`. The sequence is repeatable at will on affected hardware with no condition outside the attacker\u0027s influence.\\nPR:L - No privilege is needed to enter the vulnerable state: the memdev unbind that invalidates the mappings is performed by the kernel error handler itself, not by an administrator. CXL Type-3 media is surfaced as an ordinary System-RAM NUMA node that any unprivileged local user can allocate from and drive CXL.mem RAS reporting against, so basic local user access suffices to keep error notifications flowing into the stale-pointer path.\\nUI:N - No victim action is required; PCIe AER/DPC notifications are consumed automatically by the kernel recovery worker, which invokes `cxl_error_detected()`/`cxl_cor_error_detected()` without any user involvement.\\nS:U - The stale `__iomem` dereference, disclosure, and corruption all occur inside the kernel\u0027s own security authority in the CXL core driver, with no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - `dport-\u003eregs.ras`/`dport-\u003eregs.dport_aer` dangle into the shared vmalloc/ioremap address space after `devm_iounmap()`, and `header_log_copy()` reads 512 bytes from that address into the `cxl_aer_uncorrectable_error` trace event; once the range is recycled by another `ioremap()`/`vmalloc()` this leaks foreign device registers or kernel memory, a use-after-unmap read primitive.\\nI:H - `__cxl_handle_ras()` and `__cxl_handle_cor_ras()` perform `writel()` through the same dangling mapping, storing a status value back at a fixed offset; after the VA is reclaimed this corrupts whatever now occupies it \\u2014 another device\u0027s MMIO window or a recycled vmalloc allocation \\u2014 giving a groomable write primitive alongside the read.\\nA:H - The documented and near-certain outcome is an immediate kernel page fault on a not-present page inside `__cxl_handle_ras()` running in the AER recovery path, producing an oops (panic with `panic_on_oops`) and taking down a host whose main memory is the CXL device being torn down.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab\", \"lessThan\": \"21e5e84f3f63fdf44e49642a6e45cd895e921a84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab\", \"lessThan\": \"eef5c7b28dbecd6b141987a96db6c54e49828102\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/cxl/core/pci.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/cxl/core/pci.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84\"}, {\"url\": \"https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\\n\\nThe PCI AER model is an awkward fit for CXL error handling. While the\\nexpectation is that a PCI device can escalate to link reset to recover\\nfrom an AER event, the same reset on CXL amounts to a surprise memory\\nhotplug of massive amounts of memory.\\n\\nAt present, the CXL error handler attempts some optimistic error\\nhandling to unbind the device from the cxl_mem driver after reaping some\\nRAS register values. This results in a \\\"hopeful\\\" attempt to unplug the\\nmemory, but there is no guarantee that will succeed.\\n\\nA subsequent AER notification after the memdev unbind event can no\\nlonger assume the registers are mapped. Check for memdev bind before\\nreaping status register values to avoid crashes of the form:\\n\\n BUG: unable to handle page fault for address: ffa00000195e9100\\n #PF: supervisor read access in kernel mode\\n #PF: error_code(0x0000) - not-present page\\n [...]\\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\\n [...]\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? __die+0x24/0x70\\n  ? page_fault_oops+0x82/0x160\\n  ? kernelmode_fixup_or_oops+0x84/0x110\\n  ? exc_page_fault+0x113/0x170\\n  ? asm_exc_page_fault+0x26/0x30\\n  ? __pfx_dpc_reset_link+0x10/0x10\\n  ? __cxl_handle_ras+0x30/0x110 [cxl_core]\\n  ? find_cxl_port+0x59/0x80 [cxl_core]\\n  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\\n  cxl_error_detected+0x6c/0xf0 [cxl_core]\\n  report_error_detected+0xc7/0x1c0\\n  pci_walk_bus+0x73/0x90\\n  pcie_do_recovery+0x23f/0x330\\n\\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\\nneed to be replaced with a new PCI_ERS_RESULT_PANIC.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:04.300Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26762\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:04.300Z\", \"dateReserved\": \"2024-02-19T14:20:24.172Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:45.655Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.