CVE-2024-26762 (GCVE-0-2024-26762)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-08-05 11:27
VLAI
Title
cxl/pci: Skip to handle RAS errors if CXL.mem device is detached
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/pci: Skip to handle RAS errors if CXL.mem device is detached The PCI AER model is an awkward fit for CXL error handling. While the expectation is that a PCI device can escalate to link reset to recover from an AER event, the same reset on CXL amounts to a surprise memory hotplug of massive amounts of memory. At present, the CXL error handler attempts some optimistic error handling to unbind the device from the cxl_mem driver after reaping some RAS register values. This results in a "hopeful" attempt to unplug the memory, but there is no guarantee that will succeed. A subsequent AER notification after the memdev unbind event can no longer assume the registers are mapped. Check for memdev bind before reaping status register values to avoid crashes of the form: BUG: unable to handle page fault for address: ffa00000195e9100 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core] [...] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x160 ? kernelmode_fixup_or_oops+0x84/0x110 ? exc_page_fault+0x113/0x170 ? asm_exc_page_fault+0x26/0x30 ? __pfx_dpc_reset_link+0x10/0x10 ? __cxl_handle_ras+0x30/0x110 [cxl_core] ? find_cxl_port+0x59/0x80 [cxl_core] cxl_handle_rp_ras+0xbc/0xd0 [cxl_core] cxl_error_detected+0x6c/0xf0 [cxl_core] report_error_detected+0xc7/0x1c0 pci_walk_bus+0x73/0x90 pcie_do_recovery+0x23f/0x330 Longer term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might need to be replaced with a new PCI_ERS_RESULT_PANIC.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-05 18:38 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab , < 21e5e84f3f63fdf44e49642a6e45cd895e921a84 (git)
Affected: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab , < eef5c7b28dbecd6b141987a96db6c54e49828102 (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T18:38:38.263308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:18.559Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.382Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21e5e84f3f63fdf44e49642a6e45cd895e921a84",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            },
            {
              "lessThan": "eef5c7b28dbecd6b141987a96db6c54e49828102",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\n\nThe PCI AER model is an awkward fit for CXL error handling. While the\nexpectation is that a PCI device can escalate to link reset to recover\nfrom an AER event, the same reset on CXL amounts to a surprise memory\nhotplug of massive amounts of memory.\n\nAt present, the CXL error handler attempts some optimistic error\nhandling to unbind the device from the cxl_mem driver after reaping some\nRAS register values. This results in a \"hopeful\" attempt to unplug the\nmemory, but there is no guarantee that will succeed.\n\nA subsequent AER notification after the memdev unbind event can no\nlonger assume the registers are mapped. Check for memdev bind before\nreaping status register values to avoid crashes of the form:\n\n BUG: unable to handle page fault for address: ffa00000195e9100\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n [...]\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  ? __die+0x24/0x70\n  ? page_fault_oops+0x82/0x160\n  ? kernelmode_fixup_or_oops+0x84/0x110\n  ? exc_page_fault+0x113/0x170\n  ? asm_exc_page_fault+0x26/0x30\n  ? __pfx_dpc_reset_link+0x10/0x10\n  ? __cxl_handle_ras+0x30/0x110 [cxl_core]\n  ? find_cxl_port+0x59/0x80 [cxl_core]\n  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\n  cxl_error_detected+0x6c/0xf0 [cxl_core]\n  report_error_detected+0xc7/0x1c0\n  pci_walk_bus+0x73/0x90\n  pcie_do_recovery+0x23f/0x330\n\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\nneed to be replaced with a new PCI_ERS_RESULT_PANIC."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only reachable through the local PCIe AER/DPC error-reporting path (`pcie_do_recovery()` \u2192 `report_error_detected()` \u2192 `cxl_error_detected()`) on a CXL-attached host; there is no network- or peer-supplied data involved. Local access to the machine hosting the CXL memory device is the applicable vector, and it is the higher-severity of the two candidate vectors (Local vs. Physical device manipulation).\nAC:L - The vulnerable state is entered deterministically \u2014 the kernel\u0027s own handler calls `device_release_driver()` on the first uncorrectable/frozen event, unmapping the devm-owned RAS/AER blocks \u2014 and any following AER notification unconditionally dereferences the stale `dport-\u003eregs.ras`. The sequence is repeatable at will on affected hardware with no condition outside the attacker\u0027s influence.\nPR:L - No privilege is needed to enter the vulnerable state: the memdev unbind that invalidates the mappings is performed by the kernel error handler itself, not by an administrator. CXL Type-3 media is surfaced as an ordinary System-RAM NUMA node that any unprivileged local user can allocate from and drive CXL.mem RAS reporting against, so basic local user access suffices to keep error notifications flowing into the stale-pointer path.\nUI:N - No victim action is required; PCIe AER/DPC notifications are consumed automatically by the kernel recovery worker, which invokes `cxl_error_detected()`/`cxl_cor_error_detected()` without any user involvement.\nS:U - The stale `__iomem` dereference, disclosure, and corruption all occur inside the kernel\u0027s own security authority in the CXL core driver, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `dport-\u003eregs.ras`/`dport-\u003eregs.dport_aer` dangle into the shared vmalloc/ioremap address space after `devm_iounmap()`, and `header_log_copy()` reads 512 bytes from that address into the `cxl_aer_uncorrectable_error` trace event; once the range is recycled by another `ioremap()`/`vmalloc()` this leaks foreign device registers or kernel memory, a use-after-unmap read primitive.\nI:H - `__cxl_handle_ras()` and `__cxl_handle_cor_ras()` perform `writel()` through the same dangling mapping, storing a status value back at a fixed offset; after the VA is reclaimed this corrupts whatever now occupies it \u2014 another device\u0027s MMIO window or a recycled vmalloc allocation \u2014 giving a groomable write primitive alongside the read.\nA:H - The documented and near-certain outcome is an immediate kernel page fault on a not-present page inside `__cxl_handle_ras()` running in the AER recovery path, producing an oops (panic with `panic_on_oops`) and taking down a host whose main memory is the CXL device being torn down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:04.300Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
        },
        {
          "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
        }
      ],
      "title": "cxl/pci: Skip to handle RAS errors if CXL.mem device is detached",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26762",
    "datePublished": "2024-04-03T17:00:45.655Z",
    "dateReserved": "2024-02-19T14:20:24.172Z",
    "dateUpdated": "2026-08-05T11:27:04.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26762",
      "date": "2026-10-03",
      "epss": "0.00218",
      "percentile": "0.11074"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/cxl/core/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "21e5e84f3f63fdf44e49642a6e45cd895e921a84",
                    "status": "affected",
                    "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eef5c7b28dbecd6b141987a96db6c54e49828102",
                    "status": "affected",
                    "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/cxl/core/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "575EE16B-67F2-4B5B-B5F8-1877715C898B",
                    "versionEndExcluding": "6.7.7",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\n\nThe PCI AER model is an awkward fit for CXL error handling. While the\nexpectation is that a PCI device can escalate to link reset to recover\nfrom an AER event, the same reset on CXL amounts to a surprise memory\nhotplug of massive amounts of memory.\n\nAt present, the CXL error handler attempts some optimistic error\nhandling to unbind the device from the cxl_mem driver after reaping some\nRAS register values. This results in a \"hopeful\" attempt to unplug the\nmemory, but there is no guarantee that will succeed.\n\nA subsequent AER notification after the memdev unbind event can no\nlonger assume the registers are mapped. Check for memdev bind before\nreaping status register values to avoid crashes of the form:\n\n BUG: unable to handle page fault for address: ffa00000195e9100\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n [...]\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  ? __die+0x24/0x70\n  ? page_fault_oops+0x82/0x160\n  ? kernelmode_fixup_or_oops+0x84/0x110\n  ? exc_page_fault+0x113/0x170\n  ? asm_exc_page_fault+0x26/0x30\n  ? __pfx_dpc_reset_link+0x10/0x10\n  ? __cxl_handle_ras+0x30/0x110 [cxl_core]\n  ? find_cxl_port+0x59/0x80 [cxl_core]\n  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\n  cxl_error_detected+0x6c/0xf0 [cxl_core]\n  report_error_detected+0xc7/0x1c0\n  pci_walk_bus+0x73/0x90\n  pcie_do_recovery+0x23f/0x330\n\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\nneed to be replaced with a new PCI_ERS_RESULT_PANIC."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: cxl/pci: omita para manejar errores RAS si el dispositivo CXL.mem est\u00e1 desconectado. El modelo PCI AER no es adecuado para el manejo de errores CXL. Si bien la expectativa es que un dispositivo PCI pueda escalar hasta restablecer el enlace para recuperarse de un evento AER, el mismo restablecimiento en CXL equivale a una conexi\u00f3n en caliente sorpresa de cantidades masivas de memoria. Actualmente, el controlador de errores CXL intenta un manejo optimista de errores para desvincular el dispositivo del controlador cxl_mem despu\u00e9s de obtener algunos valores de registro RAS. Esto da como resultado un intento \"esperanzador\" de desconectar la memoria, pero no hay garant\u00eda de que tenga \u00e9xito. Una notificaci\u00f3n AER posterior despu\u00e9s del evento de desvinculaci\u00f3n de memdev ya no puede asumir que los registros est\u00e1n asignados. Verifique el enlace de memdev antes de obtener los valores del registro de estado para evitar fallas del tipo: ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: ffa00000195e9100 #PF: acceso de lectura del supervisor en modo kernel #PF: c\u00f3digo_error(0x0000) - p\u00e1gina no presente [. ..] RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core] [...] Seguimiento de llamadas: ? __morir+0x24/0x70 ? page_fault_oops+0x82/0x160? kernelmode_fixup_or_oops+0x84/0x110? exc_page_fault+0x113/0x170? asm_exc_page_fault+0x26/0x30? __pfx_dpc_reset_link+0x10/0x10 ? __cxl_handle_ras+0x30/0x110 [cxl_core] ? find_cxl_port+0x59/0x80 [cxl_core] cxl_handle_rp_ras+0xbc/0xd0 [cxl_core] cxl_error_detected+0x6c/0xf0 [cxl_core] report_error_detected+0xc7/0x1c0 pci_walk_bus+0x73/0x90 pcie_do_recovery+0x23f/0x330 A m\u00e1s largo plazo, es posible que sea necesario corregir el comportamiento de desvinculaci\u00f3n y PCI_ERS_RESULT_DISCONNECT. ser reemplazado por un nuevo PCI_ERS_RESULT_PANIC."
          }
        ],
        "id": "CVE-2024-26762",
        "lastModified": "2026-08-04T11:17:01.497",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26762",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T18:38:38.263308Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-03T17:15:52.470",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:50:35+00:00",
      "cve": "CVE-2024-26762",
      "id": "CVE-2024-26762",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cxl/pci: Skip to handle RAS errors if CXL.mem device is detached",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26762.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:14:13.382Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26762",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-04-05T18:38:38.263308Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:22.318Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/cxl/core/pci.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "21e5e84f3f63fdf44e49642a6e45cd895e921a84",
                  "status": "affected",
                  "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
                  "versionType": "git"
                },
                {
                  "lessThan": "eef5c7b28dbecd6b141987a96db6c54e49828102",
                  "status": "affected",
                  "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/cxl/core/pci.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.7"
                },
                {
                  "lessThan": "6.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.7",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\n\nThe PCI AER model is an awkward fit for CXL error handling. While the\nexpectation is that a PCI device can escalate to link reset to recover\nfrom an AER event, the same reset on CXL amounts to a surprise memory\nhotplug of massive amounts of memory.\n\nAt present, the CXL error handler attempts some optimistic error\nhandling to unbind the device from the cxl_mem driver after reaping some\nRAS register values. This results in a \"hopeful\" attempt to unplug the\nmemory, but there is no guarantee that will succeed.\n\nA subsequent AER notification after the memdev unbind event can no\nlonger assume the registers are mapped. Check for memdev bind before\nreaping status register values to avoid crashes of the form:\n\n BUG: unable to handle page fault for address: ffa00000195e9100\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n [...]\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  ? __die+0x24/0x70\n  ? page_fault_oops+0x82/0x160\n  ? kernelmode_fixup_or_oops+0x84/0x110\n  ? exc_page_fault+0x113/0x170\n  ? asm_exc_page_fault+0x26/0x30\n  ? __pfx_dpc_reset_link+0x10/0x10\n  ? __cxl_handle_ras+0x30/0x110 [cxl_core]\n  ? find_cxl_port+0x59/0x80 [cxl_core]\n  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\n  cxl_error_detected+0x6c/0xf0 [cxl_core]\n  report_error_detected+0xc7/0x1c0\n  pci_walk_bus+0x73/0x90\n  pcie_do_recovery+0x23f/0x330\n\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\nneed to be replaced with a new PCI_ERS_RESULT_PANIC."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable code is only reachable through the local PCIe AER/DPC error-reporting path (`pcie_do_recovery()` \u2192 `report_error_detected()` \u2192 `cxl_error_detected()`) on a CXL-attached host; there is no network- or peer-supplied data involved. Local access to the machine hosting the CXL memory device is the applicable vector, and it is the higher-severity of the two candidate vectors (Local vs. Physical device manipulation).\nAC:L - The vulnerable state is entered deterministically \u2014 the kernel\u0027s own handler calls `device_release_driver()` on the first uncorrectable/frozen event, unmapping the devm-owned RAS/AER blocks \u2014 and any following AER notification unconditionally dereferences the stale `dport-\u003eregs.ras`. The sequence is repeatable at will on affected hardware with no condition outside the attacker\u0027s influence.\nPR:L - No privilege is needed to enter the vulnerable state: the memdev unbind that invalidates the mappings is performed by the kernel error handler itself, not by an administrator. CXL Type-3 media is surfaced as an ordinary System-RAM NUMA node that any unprivileged local user can allocate from and drive CXL.mem RAS reporting against, so basic local user access suffices to keep error notifications flowing into the stale-pointer path.\nUI:N - No victim action is required; PCIe AER/DPC notifications are consumed automatically by the kernel recovery worker, which invokes `cxl_error_detected()`/`cxl_cor_error_detected()` without any user involvement.\nS:U - The stale `__iomem` dereference, disclosure, and corruption all occur inside the kernel\u0027s own security authority in the CXL core driver, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `dport-\u003eregs.ras`/`dport-\u003eregs.dport_aer` dangle into the shared vmalloc/ioremap address space after `devm_iounmap()`, and `header_log_copy()` reads 512 bytes from that address into the `cxl_aer_uncorrectable_error` trace event; once the range is recycled by another `ioremap()`/`vmalloc()` this leaks foreign device registers or kernel memory, a use-after-unmap read primitive.\nI:H - `__cxl_handle_ras()` and `__cxl_handle_cor_ras()` perform `writel()` through the same dangling mapping, storing a status value back at a fixed offset; after the VA is reclaimed this corrupts whatever now occupies it \u2014 another device\u0027s MMIO window or a recycled vmalloc allocation \u2014 giving a groomable write primitive alongside the read.\nA:H - The documented and near-certain outcome is an immediate kernel page fault on a not-present page inside `__cxl_handle_ras()` running in the AER recovery path, producing an oops (panic with `panic_on_oops`) and taking down a host whose main memory is the CXL device being torn down."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:27:04.300Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
            },
            {
              "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
            }
          ],
          "title": "cxl/pci: Skip to handle RAS errors if CXL.mem device is detached",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26762",
        "datePublished": "2024-04-03T17:00:45.655Z",
        "dateReserved": "2024-02-19T14:20:24.172Z",
        "dateUpdated": "2026-08-05T11:27:04.300Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.