CVE-2026-31530
published 2026-04-22CVE-2026-31530: In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
cxl_detach_ep() is called during bottom-up removal when all CXL memory
devices beneath a switch port have been removed. For each port in the
hierarchy it locks both the port and its parent, removes the endpoint,
and if the port is now empty, marks it dead and unregisters the port
by calling delete_switch_port(). There are two places during this work
where the parent_port may be used after freeing:
First, a concurrent detach may have already processed a port by the
time a second worker finds it via bus_find_device(). Without pinning
parent_port, it may already be freed when we discover port->dead and
attempt to unlock the parent_port. In a production kernel that's a
silent memory corruption, with lock debug, it looks like this:
[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())
[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310
[]Call Trace:
[]mutex_unlock+0xd/0x20
[]cxl_detach_ep+0x180/0x400 [cxl_core]
[]devm_action_release+0x10/0x20
[]devres_release_all+0xa8/0xe0
[]device_unbind_cleanup+0xd/0xa0
[]really_probe+0x1a6/0x3e0
Second, delete_switch_port() releases three devm actions registered
against parent_port. The last of those is unregister_port() and it
calls device_unregister() on the child port, which can cascade. If
parent_port is now also empty the device core may unregister and free
it too. So by the time delete_switch_port() returns, parent_port may
be free, and the subsequent device_unlock(&parent_port->dev) operates
on freed memory. The kernel log looks same as above, with a different
offset in cxl_detach_ep().
Both of these issues stem from the absence of a lifetime guarantee
between a child port and its parent port.
Establish a lifetime rule for ports: child ports hold a reference to
their parent device until release. Take the reference when the port
is allocated and drop it when rele
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 2345df54249c6fb7779e2a72b427ee79ed3eaad5 < d216a4bd138eb57cc4ae7c43b2f709e3482af7e2 | d216a4bd138eb57cc4ae7c43b2f709e3482af7e2 |
| linux | linux | >= 2345df54249c6fb7779e2a72b427ee79ed3eaad5 < 2c32141462045cf93d54a5146a0ba572b83533dd | 2c32141462045cf93d54a5146a0ba572b83533dd |
| linux | linux | >= 2345df54249c6fb7779e2a72b427ee79ed3eaad5 < f7dc6f381a1e5f068333f1faa9265d6af1df4235 | f7dc6f381a1e5f068333f1faa9265d6af1df4235 |
| linux | linux | >= 2345df54249c6fb7779e2a72b427ee79ed3eaad5 < 19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4 | 19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.13 < 6.18.21 | 6.18.21 |
| linux | linux_kernel | >= 6.19 < 6.19.11 | 6.19.11 |
| linux | linux_kernel | >= 6.3 < 6.12.80 | 6.12.80 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep()
vendor_redhat·2026-04-22·CVSS 7.0
CVE-2026-31530 [MEDIUM] kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep()
kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep()
No description is available for this CVE.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 9) - Affected
GHSA
GHSA-6pf8-h7c8-42fv: In the Linux kernel, the following vulnerability has been resolved:
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
cxl_detach_ep() i
ghsa_unreviewed·2026-04-22
CVE-2026-31530 GHSA-6pf8-h7c8-42fv: In the Linux kernel, the following vulnerability has been resolved:
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
cxl_detach_ep() i
In the Linux kernel, the following vulnerability has been resolved:
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
cxl_detach_ep() is called during bottom-up removal when all CXL memory
devices beneath a switch port have been removed. For each port in the
hierarchy it locks both the port and its parent, removes the endpoint,
and if the port is now empty, marks it dead and unregisters the port
by calling delete_switch_port(). There are two places during this work
where the parent_port may be used after freeing:
First, a concurrent detach may have already processed a port by the
time a second worker finds it via bus_find_device(). Without pinning
parent_port, it may already be freed when we discover port->dead and
attempt to unlock the parent_port. In a production kernel t
No detection rules found.
No public exploits indexed.
2026-04-22
Published