Skip to content
Fencer Vulns
high 7.8

CVE-2024-50226 json

cxl/port: Fix use-after-free, permit out-of-order decoder shutdown

published 2024-11-09 23 mo ago modified 2026-10-30 9 d ago also EUVD-2024-45157

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

cxl/port: Fix use-after-free, permit out-of-order decoder shutdown

In support of investigating an initialization failure report [1], cxl_test was updated to register mock memory-devices after the mock root-port/bus device had been registered. That led to cxl_test crashing with a use-after-free bug with the following signature:

cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1 cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1 cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0 1) cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1 [..] cxld_unregister: cxl decoder14.0: cxl_region_decode_reset: cxl_region region3: mock_decoder_reset: cxl_port port3: decoder3.0 reset 2) mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1 cxl_endpoint_decoder_release: cxl decoder14.0: [..] cxld_unregister: cxl decoder7.0: 3) cxl_region_decode_reset: cxl_region region3: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI [..] RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core] [..] Call Trace: <TASK> cxl_region_decode_reset+0x69/0x190 [cxl_core] cxl_region_detach+0xe8/0x210 [cxl_core] cxl_decoder_kill_region+0x27/0x40 [cxl_core] cxld_unregister+0x5d/0x60 [cxl_core]

At 1) a region has been established with 2 endpoint decoders (7.0 and 14.0). Those endpoints share a common switch-decoder in the topology (3.0). At teardown, 2), decoder14.0 is the first to be removed and hits the "out of order reset case" in the switch decoder. The effect though is that region3 cleanup is aborted leaving it in-tact and referencing decoder14.0. At 3) the second attempt to teardown region3 trips over the stale decoder14.0 object which has long since been deleted.

The fix here is to recognize that the CXL specification places no mandate on in-order shutdown of switch-decoders, the driver enforces in-order allocation, and hardware enforces in-order commit. So, rather than fail and leave objects dangling, always remove them.

In support of making cxl_region_decode_reset() always succeed, cxl_region_invalidate_memregion() failures are turned into warnings. Crashing the kernel is ok there since system integrity is at risk if caches cannot be managed around physical address mutation events like CXL region destruction.

A new device_for_each_child_reverse_from() is added to cleanup port->commit_end after all dependent decoders have been disabled. In other words if decoders are allocated 0->1->2 and disabled 1->2->0 then port->commit_end only decrements from 2 after 2 has been disabled, and it decrements all the way to zero since 1 was disabled previously.

Patch / fix

  • Linux Linux 6.1.191, 6.6.60, 6.11.7, 6.12
  • linux Debian 14, Debian 13 6.11.7-1

debian advisories DEBIAN-CVE-2024-50226

  • linux Ubuntu 24.04 LTS 6.8.0-58.60
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1027.29
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1028.30
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1023.27
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1024.24
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1027.32
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1010.12
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1028.32

ubuntu advisories UBUNTU-CVE-2024-50226

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-503.15.1.el9_5
  • rv RHEL 9 5.14.0-503.15.1.el9_5
  • perf RHEL 9 5.14.0-503.15.1.el9_5
  • rtla RHEL 9 5.14.0-503.15.1.el9_5
  • bpftool RHEL 9 7.4.0-503.15.1.el9_5
  • libperf RHEL 9 5.14.0-503.15.1.el9_5
  • kernel-rt RHEL 9 5.14.0-503.15.1.el9_5
  • kernel-64k RHEL 9 5.14.0-503.15.1.el9_5

red hat advisories RHSA-2024:10274

  • kernel-source-longterm openSUSE Tumbleweed 6.12.11-1.1
  • kernel-source openSUSE Tumbleweed 6.11.8-1.1

opensuse advisories openSUSE-SU-2025:14705-1openSUSE-SU-2024:14500-1

  • kernel AlmaLinux 9 5.14.0-503.15.1.el9_5
  • rv AlmaLinux 9 5.14.0-503.15.1.el9_5
  • perf AlmaLinux 9 5.14.0-503.15.1.el9_5
  • rtla AlmaLinux 9 5.14.0-503.15.1.el9_5
  • bpftool AlmaLinux 9 7.4.0-503.15.1.el9_5
  • libperf AlmaLinux 9 5.14.0-503.15.1.el9_5
  • kernel-rt AlmaLinux 9 5.14.0-503.15.1.el9_5
  • kernel-64k AlmaLinux 9 5.14.0-503.15.1.el9_5

almalinux advisories ALSA-2024:10274

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-50226 updated cvss 6.7

kernel: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder (v. 9) libperf 5.14.0-503.15.1.el9_5, kernel-debuginfo-common-s390x 5.14.0-503.15.1.el9_5, kernel-debuginfo-common-x86_64 5.14.0-503.15.1.el9_5, kernel-debuginfo-common-aarch64 5.14.0-503.15.1.el9_5, kernel-debuginfo-common-ppc64le 5.14.0-503.15.1.el9_5 Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-503.15.1.el9_5, perf 5.14.0-503.15.1.el9_5, rtla 5.14.0-503.15.1.el9_5, kernel-devel-matched 5.14.0-503.15.1.el9_5, kernel-64k-devel-matched 5.14.0-503.15.1.el9_5, kernel-debug-devel-matched 5.14.0-503.15.1.el9_5, +6 more Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.4.0-503.15.1.el9_5, kernel 5.14.0-503.15.1.el9_5, kernel-64k 5.14.0-503.15.1.el9_5, kernel-core 5.14.0-503.15.1.el9_5, kernel-tools 5.14.0-503.15.1.el9_5, python3-perf 5.14.0-503.15.1.el9_5, +29 more Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-503.15.1.el9_5, kernel-rt-core 5.14.0-503.15.1.el9_5, kernel-rt-modules 5.14.0-503.15.1.el9_5, kernel-rt-debug-core 5.14.0-503.15.1.el9_5, kernel-rt-modules-core 5.14.0-503.15.1.el9_5, kernel-rt-debug-modules 5.14.0-503.15.1.el9_5, +4 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-503.15.1.el9_5, kernel-rt-kvm 5.14.0-503.15.1.el9_5, kernel-rt-core 5.14.0-503.15.1.el9_5, kernel-rt-modules 5.14.0-503.15.1.el9_5, kernel-rt-debug-kvm 5.14.0-503.15.1.el9_5, kernel-rt-debug-core 5.14.0-503.15.1.el9_5, +6 more
    fixed: vendor fix RHSA-2024:10274
  • Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
22 mo ago

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.