CVE-2022-48707

What it actually does

Null pointer dereference in cxl_region_decode_reset when unconditionally invoking the reset callback on a pass-through decoder instance that lacks the callback, occurring in host bridges with a single root port that use implicit rather than explicit HDM decoders.

Why it matters to the business

Kernel panic and system crash when destroying CXL regions on affected single-root-port configurations, causing downtime for workloads relying on CXL-attached memory devices.

How an attack unfolds

An attacker with sufficient privileges to create a CXL region on a qualifying single-root-port host bridge configuration then destroys the region, triggering the unconditional reset callback on the pass-through decoder and causing an immediate kernel crash.

How to fix it

Upgrade the Linux kernel to a version containing commit a04c7d062b537ff787d00da95bdfe343260d4beb or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit a04c7d062b537ff787d00da95bdfe343260d4beb, then repeat region create/destroy operations on single-root-port CXL hardware to verify absence of the crash.

Typical attack path

1. Identify or configure a CXL setup consisting of one host bridge, one root port, and directly attached type-3 memory devices
2. Create a region using the CXL region driver
3. Destroy the region (for example via cxl destroy-region)
4. Trigger unconditional invocation of the missing reset callback leading to null dereference and kernel panic

How to detect it

Inspect kernel logs and crash dumps for null pointer dereference in cxl_region_decode_reset or related CXL decoder reset paths during region teardown.

• cxl_region_decode_reset
• pass through decoder
• cxl destroy-region

What your security team should do

• Apply the referenced kernel commit immediately on any system exposing CXL regions
• Audit CXL hardware configurations for single-root-port host bridges
• Monitor kernel logs for CXL decoder reset oops until patches are deployed