CVE-2024-26761

cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window

State
Published
Severity
Not scored
Published
Apr 3, 2024
Updated
May 11, 2026
Reserved
Feb 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window

The Linux CXL subsystem is built on the assumption that HPA == SPA. That is, the host physical address (HPA) the HDM decoder registers are programmed with are system physical addresses (SPA).

During HDM decoder setup, the DVSEC CXL range registers (cxl-3.1, 8.1.3.8) are checked if the memory is enabled and the CXL range is in a HPA window that is described in a CFMWS structure of the CXL host bridge (cxl-3.1, 9.18.1.3).

Now, if the HPA is not an SPA, the CXL range does not match a CFMWS window and the CXL memory range will be disabled then. The HDM decoder stops working which causes system memory being disabled and further a system hang during HDM decoder initialization, typically when a CXL enabled kernel boots.

Prevent a system hang and do not disable the HDM decoder if the decoder's CXL range is not found in a CFMWS window.

Note the change only fixes a hardware hang, but does not implement HPA/SPA translation. Support for this can be added in a follow on patch series.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 34e37b4c432cd0f1842b352fde4b8878b4166888 to before 031217128990d7f0ab8c46db1afb3cf1e075fd29Affected
  • 34e37b4c432cd0f1842b352fde4b8878b4166888 to before 2cc1a530ab31c65b52daf3cb5d0883c8b614ea69Affected
  • 34e37b4c432cd0f1842b352fde4b8878b4166888 to before 3a3181a71935774bda2398451256d7441426420bAffected
  • 34e37b4c432cd0f1842b352fde4b8878b4166888 to before 0cab687205986491302cd2e440ef1d253031c221Affected
LinuxLinux
  • 5.19Affected
  • before 5.19Not affected
  • 6.1.80 through 6.1.*Not affected
  • 6.6.19 through 6.6.*Not affected
  • 6.7.7 through 6.7.*Not affected
  • 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.