CVE-2024-41085

What it actually does

Triggers a kernel NULL pointer dereference in cxl_pmem_region_probe during CXL pmem region auto-assembly because cxl_nvd is registered after the endpoint port probe that can invoke the region probe.

Why it matters to the business

Systems using CXL-attached persistent memory may experience unexpected kernel crashes and reboots during boot or hot-plug events, leading to downtime and potential data loss in memory-intensive workloads.

How an attack unfolds

An attacker with local access or a physical CXL device attachment can trigger endpoint port probing that auto-assembles a pmem region before the required cxl_nvd structure exists, causing the NULL dereference and kernel panic.

How to fix it

Update the Linux kernel to a version containing commit 1d064e4fbebcf5b18dc10c1f3973487eb163b600 or later; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 1d064e4fbebcf5b18dc10c1f3973487eb163b600; attempt CXL pmem region auto-assembly with endpoint probing and verify absence of the NULL pointer call trace.

Typical attack path

1. Attach or enumerate a CXL endpoint port during system operation or boot
2. Trigger automatic pmem region assembly via cxl_bus_probe
3. Invoke cxl_pmem_region_probe before cxl_nvd registration completes
4. Access uninitialized pointer at offset 0x78 resulting in page fault and crash

How to detect it

Inspect kernel logs for BUG: kernel NULL pointer dereference messages referencing cxl_pmem_region_probe; correlate with CXL endpoint device addition events in dmesg or journalctl.

What your security team should do

• Prioritize kernel upgrade on all CXL-enabled hosts within the next maintenance window
• Monitor boot and device-probe logs for cxl_pmem_region_probe call traces until patched
• Test CXL memory devices in a lab environment with the fixed kernel before broad deployment