Skip to content
Fencer Vulns
high 7.8

CVE-2026-31530 json

cxl/port: Fix use after free of parent_port in cxl_detach_ep()

published 2026-04-22 6 mo ago modified 2026-11-05 3 d ago also EUVD-2026-24925

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

cxl/port: Fix use after free of parent_port in cxl_detach_ep()

cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by calling delete_switch_port(). There are two places during this work where the parent_port may be used after freeing:

First, a concurrent detach may have already processed a port by the time a second worker finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory corruption, with lock debug, it looks like this:

[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace: []mutex_unlock+0xd/0x20 []cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20 []devres_release_all+0xa8/0xe0 []device_unbind_cleanup+0xd/0xa0 []really_probe+0x1a6/0x3e0

Second, delete_switch_port() releases three devm actions registered against parent_port. The last of those is unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is now also empty the device core may unregister and free it too. So by the time delete_switch_port() returns, parent_port may be free, and the subsequent device_unlock(&parent_port->dev) operates on freed memory. The kernel log looks same as above, with a different offset in cxl_detach_ep().

Both of these issues stem from the absence of a lifetime guarantee between a child port and its parent port.

Establish a lifetime rule for ports: child ports hold a reference to their parent device until release. Take the reference when the port is allocated and drop it when released. This ensures the parent is valid for the full lifetime of the child and eliminates the use after free window in cxl_detach_ep().

This is easily reproduced with a reload of cxl_acpi in QEMU with CXL devices present.

Patch / fix

  • Linux Linux 6.6.160, 6.12.80, 6.18.21, 6.19.11, 7.0
  • linux Debian 13 6.12.85-1
  • linux Debian 14 6.19.11-1

debian advisories DEBIAN-CVE-2026-31530

  • linux Ubuntu 24.04 LTS 6.8.0-136.136
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1061.64
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1064.72
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1059.67
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1061.62
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1063.71
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1046.50
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1061.65

ubuntu advisories UBUNTU-CVE-2026-31530

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-687.38.1.el9_8
  • rv RHEL 9 5.14.0-687.38.1.el9_8
  • perf RHEL 9 5.14.0-687.38.1.el9_8
  • rtla RHEL 9 5.14.0-687.38.1.el9_8
  • libperf RHEL 9 5.14.0-687.38.1.el9_8
  • kernel-rt RHEL 9 5.14.0-687.38.1.el9_8
  • kernel-64k RHEL 9 5.14.0-687.38.1.el9_8
  • kernel-core RHEL 9 5.14.0-687.38.1.el9_8

red hat advisories RHSA-2026:53329RHSA-2026:42919

  • kernel-rt Linux Micro 6.2 6.12.0-160000.38.1
  • kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.38.1
  • kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.38.1
  • kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.38.1
  • kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.38.1.160000.2.23
  • kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.38.1
  • kernel-azure SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.38.1
  • kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.38.1

suse advisories SUSE-SU-2026:23887-1SUSE-SU-2026:23902-1SUSE-SU-2026:23897-1SUSE-SU-2026:23881-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.38.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.38.1

opensuse advisories openSUSE-SU-2026:21910-1

  • kernel AlmaLinux 9 5.14.0-687.38.1.el9_8
  • rv AlmaLinux 9 5.14.0-687.38.1.el9_8
  • perf AlmaLinux 9 5.14.0-687.38.1.el9_8
  • rtla AlmaLinux 9 5.14.0-687.38.1.el9_8
  • libperf AlmaLinux 9 5.14.0-687.38.1.el9_8
  • kernel-rt AlmaLinux 9 5.14.0-687.38.1.el9_8
  • kernel-64k AlmaLinux 9 5.14.0-687.38.1.el9_8
  • kernel-core AlmaLinux 9 5.14.0-687.38.1.el9_8

almalinux advisories ALSA-2026:53329ALSA-2026:42919

  • kernel Rocky Linux 9 5.14.0-687.38.1.el9_8
  • kernel Rocky Linux 10 6.12.0-211.37.1.el10_2

rocky linux advisories RLSA-2026:53329RLSA-2026:42919

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-31530 updated cvss 7.0

kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep()

  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.38.1.el9_8, perf 5.14.0-687.38.1.el9_8, rtla 5.14.0-687.38.1.el9_8, python3-perf 5.14.0-687.38.1.el9_8, kernel-devel-matched 5.14.0-687.38.1.el9_8, kernel-64k-devel-matched 5.14.0-687.38.1.el9_8, +7 more
    fixed: vendor fix RHSA-2026:53329
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.37.1.el10_2, perf 6.12.0-211.37.1.el10_2, rtla 6.12.0-211.37.1.el10_2, python3-perf 6.12.0-211.37.1.el10_2, kernel-devel-matched 6.12.0-211.37.1.el10_2, kernel-64k-devel-matched 6.12.0-211.37.1.el10_2, +7 more
    fixed: vendor fix RHSA-2026:42919
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.38.1.el9_8, kernel-64k 5.14.0-687.38.1.el9_8, kernel-core 5.14.0-687.38.1.el9_8, kernel-tools 5.14.0-687.38.1.el9_8, kernel-modules 5.14.0-687.38.1.el9_8, kernel-64k-core 5.14.0-687.38.1.el9_8, +27 more
    fixed: vendor fix RHSA-2026:53329
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.37.1.el10_2, kernel-64k 6.12.0-211.37.1.el10_2, kernel-core 6.12.0-211.37.1.el10_2, kernel-tools 6.12.0-211.37.1.el10_2, kernel-modules 6.12.0-211.37.1.el10_2, kernel-64k-core 6.12.0-211.37.1.el10_2, +28 more
    fixed: vendor fix RHSA-2026:42919
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.38.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.38.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.38.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.38.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.38.1.el9_8
    fixed: vendor fix RHSA-2026:53329
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.37.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.37.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.37.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.37.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.37.1.el10_2
    fixed: vendor fix RHSA-2026:42919
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.38.1.el9_8, kernel-rt-64k 5.14.0-687.38.1.el9_8, kernel-rt-core 5.14.0-687.38.1.el9_8, kernel-rt-modules 5.14.0-687.38.1.el9_8, kernel-rt-64k-core 5.14.0-687.38.1.el9_8, kernel-rt-debug-core 5.14.0-687.38.1.el9_8, +14 more
    fixed: vendor fix RHSA-2026:53329
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.37.1.el10_2, kernel-rt-64k 6.12.0-211.37.1.el10_2, kernel-rt-core 6.12.0-211.37.1.el10_2, kernel-rt-modules 6.12.0-211.37.1.el10_2, kernel-rt-64k-core 6.12.0-211.37.1.el10_2, kernel-rt-debug-core 6.12.0-211.37.1.el10_2, +14 more
    fixed: vendor fix RHSA-2026:42919
show 3 more
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.38.1.el9_8, kernel-rt-core 5.14.0-687.38.1.el9_8, kernel-rt-modules 5.14.0-687.38.1.el9_8, kernel-rt-debug-core 5.14.0-687.38.1.el9_8, kernel-rt-modules-core 5.14.0-687.38.1.el9_8, kernel-rt-debug-modules 5.14.0-687.38.1.el9_8, +4 more
    fixed: vendor fix RHSA-2026:53329
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.37.1.el10_2, kernel-rt-core 6.12.0-211.37.1.el10_2, kernel-rt-modules 6.12.0-211.37.1.el10_2, kernel-rt-debug-core 6.12.0-211.37.1.el10_2, kernel-rt-modules-core 6.12.0-211.37.1.el10_2, kernel-rt-debug-modules 6.12.0-211.37.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:42919
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 d ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.