CVE-2024-41084

What it actually does

Null pointer dereference in cxl_dpa_to_region() during DPA-to-region lookup when an endpoint is found but the region is not fully assembled, resulting in kernel oops.

Why it matters to the business

Unexpected system crashes or instability on Linux systems using CXL hardware, leading to downtime and operational disruption until patched.

How an attack unfolds

An attacker or test condition initiates a region lookup that races with or follows a failed BIOS-defined region assembly, triggering the assumption violation and null dereference crash.

How to fix it

Update the Linux kernel to include commit a9e099e29e925f8b31cfe53e8a786b9796f8e453 which replaces the dereference with a dev_dbg() message and adds clarifying comments.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source, reproduce region lookup scenarios post-assembly failure, and confirm no oops occurs with only debug logging.

Typical attack path

1. Identify or create conditions for CXL region lookup involving unassembled BIOS-defined regions
2. Trigger cxl_dpa_to_region() call on a memdev with mapped DPA
3. Exploit missing region assembly check to dereference null pointer and induce kernel oops

How to detect it

Inspect kernel logs and oops reports for cxl region lookup failures, particularly messages referencing dpa_to_region or null dereferences during BIOS region handling.

What your security team should do

• Prioritize kernel updates on systems with CXL support
• Review CXL region assembly logs for prior failures
• Monitor kernel crash reports for related null dereference signatures