CVE-2026-23348

published 2026-03-25

CVE-2026-23348: In the Linux kernel, the following vulnerability has been resolved: cxl: Fix race of nvdimm_bus object when creating nvdimm objects Found issue during running…

Priority P4 17 medium 4.7 CVSS 3.1

AV L AC H PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

cxl: Fix race of nvdimm_bus object when creating nvdimm objects

Found issue during running of cxl-translate.sh unit test. Adding a 3s
sleep right before the test seems to make the issue reproduce fairly
consistently. The cxl_translate module has dependency on cxl_acpi and
causes orphaned nvdimm objects to reprobe after cxl_acpi is removed.
The nvdimm_bus object is registered by the cxl_nvb object when
cxl_acpi_probe() is called. With the nvdimm_bus object missing,
__nd_device_register() will trigger NULL pointer dereference when
accessing the dev->parent that points to &nvdimm_bus->dev.

[ 192.884510] BUG: kernel NULL pointer dereference, address: 000000000000006c
[ 192.895383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20250812-19.fc42 08/12/2025
[ 192.897721] Workqueue: cxl_port cxl_bus_rescan_queue [cxl_core]
[ 192.899459] RIP: 0010:kobject_get+0xc/0x90
[ 192.924871] Call Trace:
[ 192.925959]
[ 192.926976] ? pm_runtime_init+0xb9/0xe0
[ 192.929712] __nd_device_register.part.0+0x4d/0xc0 [libnvdimm]
[ 192.933314] __nvdimm_create+0x206/0x290 [libnvdimm]
[ 192.936662] cxl_nvdimm_probe+0x119/0x1d0 [cxl_pmem]
[ 192.940245] cxl_bus_probe+0x1a/0x60 [cxl_core]
[ 192.943349] really_probe+0xde/0x380

This patch also relies on the previous change where
devm_cxl_add_nvdimm_bridge() is called from drivers/cxl/pmem.c instead
of drivers/cxl/core.c to ensure the dependency of cxl_acpi on cxl_pmem.

1. Set probe_type of cxl_nvb to PROBE_FORCE_SYNCHRONOUS to ensure the
driver is probed synchronously when add_device() is called.
2. Add a check in __devm_cxl_add_nvdimm_bridge() to ensure that the
cxl_nvb driver is attached during cxl_acpi_probe().
3. Take the cxl_root uport_dev lock and the cxl_nvb->dev lock in
devm_cxl_add_nvdimm() before checking nvdimm_bus is valid.
4. Set cxl_nvdimm flag to CXL_NVD_F_INVALIDATED so cxl_nvdimm_probe()
will exit with -EBUSY.

The removal of cxl_nvdimm devices sh

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.19.8-1 (forky)	linux 6.19.8-1 (forky)
linux	linux	—	—
linux	linux	>= 8fdcb1704f61a8fd9be0f3849a174d084def0666 < 5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7	5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7
linux	linux	>= 8fdcb1704f61a8fd9be0f3849a174d084def0666 < 5b230daeee420833287cc77314439903e5312f10	5b230daeee420833287cc77314439903e5312f10
linux	linux	>= 8fdcb1704f61a8fd9be0f3849a174d084def0666 < 96a1fd0d84b17360840f344826897fa71049870e	96a1fd0d84b17360840f344826897fa71049870e
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.19.8-1	6.19.8-1
linux	linux_kernel	>= 5.14.0 < 6.18.17	6.18.17
linux	linux_kernel	>= 5.14.1 < 6.18.17	6.18.17
linux	linux_kernel	>= 6.19 < 6.19.7	6.19.7
linux	linux_kernel	>= 6.19.0 < 6.19.7	6.19.7
msrc	azl3_kernel_6.6.126.1-1_on_azure_linux_3.0	—	—

CVSS provenance

nvd v3.1 4.7 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vendor_msrc 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-362 CWE-820