CVE-2024-26762

What it actually does

The vulnerability is a use-after-free in the CXL RAS error path: after the memdev unbinds from cxl_mem the handler still dereferences the now-unmapped RAS register window, producing a kernel page fault during AER recovery.

Why it matters to the business

Systems that use CXL-attached memory can suffer unexpected kernel crashes when PCI AER events occur after a device detach, causing unplanned downtime and loss of workloads that depend on large memory pools.

How an attack unfolds

An attacker who can induce an AER error on a CXL.mem device first triggers the optimistic unbind path; a follow-on AER notification then walks the error handler, which reads from freed register memory and crashes the kernel.

How to fix it

Upgrade to Linux kernel 6.7.7 or later, or apply commit 21e5e84f3f63fdf44e49642a6e45cd895e921a84 from the stable git tree; ensure the check for memdev bind state precedes any RAS register access.

How to confirm the fix worked

Confirm the running kernel reports version 6.7.7 or newer; inspect cxl_core for the added bind-state guard before RAS register reads and verify the crash signature no longer appears under AER injection tests.

Typical attack path

1. Trigger CXL memdev unbind via normal error handling or hotplug
2. Generate a subsequent AER notification on the same device
3. Kernel executes __cxl_handle_ras on unmapped registers
4. Page fault occurs and system crashes or panics

How to detect it

Search kernel logs and dmesg for page-fault oops mentioning __cxl_handle_ras, cxl_handle_rp_ras, or cxl_error_detected; correlate with prior CXL device detach events.

• BUG: unable to handle page fault for address: ffa00000195e9100
• __cxl_handle_ras+0x30/0x110 [cxl_core]
• cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]
• cxl_error_detected+0x6c/0xf0 [cxl_core]

What your security team should do

• Apply the fixed kernel on all hosts that expose CXL.mem devices within the next maintenance window
• Add kernel oops monitoring for cxl_handle_ras and cxl_error_detected symbols
• Exercise AER recovery paths in test environments before production rollout