CVE-2024-40936

What it actually does

The vulnerability is a memory leak of memregions in devm_cxl_add_region() because mode verification occurred after allocation, allowing resources to be allocated but never released on failure paths in the Linux kernel CXL subsystem.

Why it matters to the business

Systems using CXL hardware may experience gradual kernel memory exhaustion over repeated region operations, potentially leading to reduced stability or performance degradation in data centers and servers, though the low exploit likelihood limits immediate operational risk.

How an attack unfolds

An attacker with local access would craft repeated calls to create CXL regions with invalid modes after the allocation step to trigger leaks, but the narrow requirements on CXL-enabled hardware and lack of known campaigns make successful exploitation improbable.

How to fix it

Upgrade to fixed package versions: linux 6.1.94-1 on Debian 12 or linux 6.9.7-1 on Debian 13. Apply the upstream patch that moves mode verification before memregion allocation in __create_region().

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the listed fixed packages, review the cxl/region.c source for the reordered verification logic, and test region creation under error conditions to ensure no leaks occur.

Typical attack path

1. Obtain local access on a CXL-capable Linux system
2. Trigger region creation paths with failing mode verification after memregion allocation
3. Repeat operations to accumulate unreleased memregions

How to detect it

Monitor kernel logs and dmesg for memregion allocation warnings or failures in the CXL subsystem, and track overall kernel memory consumption trends on systems with CXL regions enabled.

What your security team should do

• Prioritize kernel upgrades on all CXL-enabled systems within standard maintenance windows
• Audit CXL region usage logs for unexpected allocation patterns
• Track EPSS and KEV status for any change in exploit maturity