CVE-2026-31530

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cxl/port: Fix use after free of parent_port in cxl_detach_ep()

cxl_detach_ep() is called during bottom-up removal when all CXL memory

devices beneath a switch port have been removed. For each port in the

hierarchy it locks both the port and its parent, removes the endpoint,

and if the port is now empty, marks it dead and unregisters the port

by calling delete_switch_port(). There are two places during this work

where the parent_port may be used after freeing:

First, a concurrent detach may have already processed a port by the

time a second worker finds it via bus_find_device(). Without pinning

parent_port, it may already be freed when we discover port->dead and

attempt to unlock the parent_port. In a production kernel that's a

silent memory corruption, with lock debug, it looks like this:

[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())

[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References