GHSA-9RP2-RCXM-VPWW

Vulnerability from github – Published: 2025-12-30 15:30 – Updated: 2025-12-30 15:30
VLAI?
Details

In the Linux kernel, the following vulnerability has been resolved:

cxl/pmem: Fix nvdimm registration races

A loop of the form:

while true; do modprobe cxl_pci; modprobe -r cxl_pci; done

...fails with the following crash signature:

BUG: kernel NULL pointer dereference, address: 0000000000000040
[..]
RIP: 0010:cxl_internal_send_cmd+0x5/0xb0 [cxl_core]
[..]
Call Trace:
 <TASK>
 cxl_pmem_ctl+0x121/0x240 [cxl_pmem]
 nvdimm_get_config_data+0xd6/0x1a0 [libnvdimm]
 nd_label_data_init+0x135/0x7e0 [libnvdimm]
 nvdimm_probe+0xd6/0x1c0 [libnvdimm]
 nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm]
 really_probe+0xde/0x380
 __driver_probe_device+0x78/0x170
 driver_probe_device+0x1f/0x90
 __device_attach_driver+0x85/0x110
 bus_for_each_drv+0x7d/0xc0
 __device_attach+0xb4/0x1e0
 bus_probe_device+0x9f/0xc0
 device_add+0x445/0x9c0
 nd_async_device_register+0xe/0x40 [libnvdimm]
 async_run_entry_fn+0x30/0x130

...namely that the bottom half of async nvdimm device registration runs after the CXL has already torn down the context that cxl_pmem_ctl() needs. Unlike the ACPI NFIT case that benefits from launching multiple nvdimm device registrations in parallel from those listed in the table, CXL is already marked PROBE_PREFER_ASYNCHRONOUS. So provide for a synchronous registration path to preclude this scenario.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-54323"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-30T13:16:21Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/pmem: Fix nvdimm registration races\n\nA loop of the form:\n\n    while true; do modprobe cxl_pci; modprobe -r cxl_pci; done\n\n...fails with the following crash signature:\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000040\n    [..]\n    RIP: 0010:cxl_internal_send_cmd+0x5/0xb0 [cxl_core]\n    [..]\n    Call Trace:\n     \u003cTASK\u003e\n     cxl_pmem_ctl+0x121/0x240 [cxl_pmem]\n     nvdimm_get_config_data+0xd6/0x1a0 [libnvdimm]\n     nd_label_data_init+0x135/0x7e0 [libnvdimm]\n     nvdimm_probe+0xd6/0x1c0 [libnvdimm]\n     nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm]\n     really_probe+0xde/0x380\n     __driver_probe_device+0x78/0x170\n     driver_probe_device+0x1f/0x90\n     __device_attach_driver+0x85/0x110\n     bus_for_each_drv+0x7d/0xc0\n     __device_attach+0xb4/0x1e0\n     bus_probe_device+0x9f/0xc0\n     device_add+0x445/0x9c0\n     nd_async_device_register+0xe/0x40 [libnvdimm]\n     async_run_entry_fn+0x30/0x130\n\n...namely that the bottom half of async nvdimm device registration runs\nafter the CXL has already torn down the context that cxl_pmem_ctl()\nneeds. Unlike the ACPI NFIT case that benefits from launching multiple\nnvdimm device registrations in parallel from those listed in the table,\nCXL is already marked PROBE_PREFER_ASYNCHRONOUS. So provide for a\nsynchronous registration path to preclude this scenario.",
  "id": "GHSA-9rp2-rcxm-vpww",
  "modified": "2025-12-30T15:30:36Z",
  "published": "2025-12-30T15:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-54323"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/18c65667fa9104780eeaa0dc1bc240f0c2094772"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a371788d4f4a7f59eecd22644331d599979fd283"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f57aec443c24d2e8e1f3b5b4856aea12ddda4254"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.