CVE-2026-31530

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31530", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.112Z", "datePublished": "2026-04-22T13:54:42.563Z", "dateUpdated": "2026-11-05T21:45:06.495Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:25.498Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use after free of parent_port in cxl_detach_ep()\n\ncxl_detach_ep() is called during bottom-up removal when all CXL memory\ndevices beneath a switch port have been removed. For each port in the\nhierarchy it locks both the port and its parent, removes the endpoint,\nand if the port is now empty, marks it dead and unregisters the port\nby calling delete_switch_port(). There are two places during this work\nwhere the parent_port may be used after freeing:\n\nFirst, a concurrent detach may have already processed a port by the\ntime a second worker finds it via bus_find_device(). Without pinning\nparent_port, it may already be freed when we discover port->dead and\nattempt to unlock the parent_port. In a production kernel that's a\nsilent memory corruption, with lock debug, it looks like this:\n\n[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())\n[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310\n[]Call Trace:\n[]mutex_unlock+0xd/0x20\n[]cxl_detach_ep+0x180/0x400 [cxl_core]\n[]devm_action_release+0x10/0x20\n[]devres_release_all+0xa8/0xe0\n[]device_unbind_cleanup+0xd/0xa0\n[]really_probe+0x1a6/0x3e0\n\nSecond, delete_switch_port() releases three devm actions registered\nagainst parent_port. The last of those is unregister_port() and it\ncalls device_unregister() on the child port, which can cascade. If\nparent_port is now also empty the device core may unregister and free\nit too. So by the time delete_switch_port() returns, parent_port may\nbe free, and the subsequent device_unlock(&parent_port->dev) operates\non freed memory. The kernel log looks same as above, with a different\noffset in cxl_detach_ep().\n\nBoth of these issues stem from the absence of a lifetime guarantee\nbetween a child port and its parent port.\n\nEstablish a lifetime rule for ports: child ports hold a reference to\ntheir parent device until release. Take the reference when the port\nis allocated and drop it when released. This ensures the parent is\nvalid for the full lifetime of the child and eliminates the use after\nfree window in cxl_detach_ep().\n\nThis is easily reproduced with a reload of cxl_acpi in QEMU with CXL\ndevices present."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/cxl/core/port.c"], "versions": [{"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "b1f62588ab1be6c9535d74348003c86b47ec4abd", "status": "affected", "versionType": "git"}, {"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "d216a4bd138eb57cc4ae7c43b2f709e3482af7e2", "status": "affected", "versionType": "git"}, {"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "2c32141462045cf93d54a5146a0ba572b83533dd", "status": "affected", "versionType": "git"}, {"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "f7dc6f381a1e5f068333f1faa9265d6af1df4235", "status": "affected", "versionType": "git"}, {"version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/cxl/core/port.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b1f62588ab1be6c9535d74348003c86b47ec4abd"}, {"url": "https://git.kernel.org/stable/c/d216a4bd138eb57cc4ae7c43b2f709e3482af7e2"}, {"url": "https://git.kernel.org/stable/c/2c32141462045cf93d54a5146a0ba572b83533dd"}, {"url": "https://git.kernel.org/stable/c/f7dc6f381a1e5f068333f1faa9265d6af1df4235"}, {"url": "https://git.kernel.org/stable/c/19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4"}], "title": "cxl/port: Fix use after free of parent_port in cxl_detach_ep()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31530", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:37:47.922657Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:06.495Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31530", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:37:47.922657Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:37:49.615Z"}}], "cna": {"title": "cxl/port: Fix use after free of parent_port in cxl_detach_ep()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "b1f62588ab1be6c9535d74348003c86b47ec4abd", "versionType": "git"}, {"status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "d216a4bd138eb57cc4ae7c43b2f709e3482af7e2", "versionType": "git"}, {"status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "2c32141462045cf93d54a5146a0ba572b83533dd", "versionType": "git"}, {"status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "f7dc6f381a1e5f068333f1faa9265d6af1df4235", "versionType": "git"}, {"status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "lessThan": "19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4", "versionType": "git"}], "programFiles": ["drivers/cxl/core/port.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/cxl/core/port.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b1f62588ab1be6c9535d74348003c86b47ec4abd"}, {"url": "https://git.kernel.org/stable/c/d216a4bd138eb57cc4ae7c43b2f709e3482af7e2"}, {"url": "https://git.kernel.org/stable/c/2c32141462045cf93d54a5146a0ba572b83533dd"}, {"url": "https://git.kernel.org/stable/c/f7dc6f381a1e5f068333f1faa9265d6af1df4235"}, {"url": "https://git.kernel.org/stable/c/19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use after free of parent_port in cxl_detach_ep()\n\ncxl_detach_ep() is called during bottom-up removal when all CXL memory\ndevices beneath a switch port have been removed. For each port in the\nhierarchy it locks both the port and its parent, removes the endpoint,\nand if the port is now empty, marks it dead and unregisters the port\nby calling delete_switch_port(). There are two places during this work\nwhere the parent_port may be used after freeing:\n\nFirst, a concurrent detach may have already processed a port by the\ntime a second worker finds it via bus_find_device(). Without pinning\nparent_port, it may already be freed when we discover port->dead and\nattempt to unlock the parent_port. In a production kernel that's a\nsilent memory corruption, with lock debug, it looks like this:\n\n[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())\n[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310\n[]Call Trace:\n[]mutex_unlock+0xd/0x20\n[]cxl_detach_ep+0x180/0x400 [cxl_core]\n[]devm_action_release+0x10/0x20\n[]devres_release_all+0xa8/0xe0\n[]device_unbind_cleanup+0xd/0xa0\n[]really_probe+0x1a6/0x3e0\n\nSecond, delete_switch_port() releases three devm actions registered\nagainst parent_port. The last of those is unregister_port() and it\ncalls device_unregister() on the child port, which can cascade. If\nparent_port is now also empty the device core may unregister and free\nit too. So by the time delete_switch_port() returns, parent_port may\nbe free, and the subsequent device_unlock(&parent_port->dev) operates\non freed memory. The kernel log looks same as above, with a different\noffset in cxl_detach_ep().\n\nBoth of these issues stem from the absence of a lifetime guarantee\nbetween a child port and its parent port.\n\nEstablish a lifetime rule for ports: child ports hold a reference to\ntheir parent device until release. Take the reference when the port\nis allocated and drop it when released. This ensures the parent is\nvalid for the full lifetime of the child and eliminates the use after\nfree window in cxl_detach_ep().\n\nThis is easily reproduced with a reload of cxl_acpi in QEMU with CXL\ndevices present."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:25.498Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31530", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:06.495Z", "dateReserved": "2026-03-09T15:48:24.112Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:42.563Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/cxl/core/port.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b1f62588ab1be6c9535d74348003c86b47ec4abd", "status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "versionType": "git"}, {"lessThan": "d216a4bd138eb57cc4ae7c43b2f709e3482af7e2", "status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "versionType": "git"}, {"lessThan": "2c32141462045cf93d54a5146a0ba572b83533dd", "status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "versionType": "git"}, {"lessThan": "f7dc6f381a1e5f068333f1faa9265d6af1df4235", "status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "versionType": "git"}, {"lessThan": "19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4", "status": "affected", "version": "2345df54249c6fb7779e2a72b427ee79ed3eaad5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/cxl/core/port.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "525BA660-423E-45E7-987B-D0A26771C45B", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use after free of parent_port in cxl_detach_ep()\n\ncxl_detach_ep() is called during bottom-up removal when all CXL memory\ndevices beneath a switch port have been removed. For each port in the\nhierarchy it locks both the port and its parent, removes the endpoint,\nand if the port is now empty, marks it dead and unregisters the port\nby calling delete_switch_port(). There are two places during this work\nwhere the parent_port may be used after freeing:\n\nFirst, a concurrent detach may have already processed a port by the\ntime a second worker finds it via bus_find_device(). Without pinning\nparent_port, it may already be freed when we discover port->dead and\nattempt to unlock the parent_port. In a production kernel that's a\nsilent memory corruption, with lock debug, it looks like this:\n\n[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())\n[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310\n[]Call Trace:\n[]mutex_unlock+0xd/0x20\n[]cxl_detach_ep+0x180/0x400 [cxl_core]\n[]devm_action_release+0x10/0x20\n[]devres_release_all+0xa8/0xe0\n[]device_unbind_cleanup+0xd/0xa0\n[]really_probe+0x1a6/0x3e0\n\nSecond, delete_switch_port() releases three devm actions registered\nagainst parent_port. The last of those is unregister_port() and it\ncalls device_unregister() on the child port, which can cascade. If\nparent_port is now also empty the device core may unregister and free\nit too. So by the time delete_switch_port() returns, parent_port may\nbe free, and the subsequent device_unlock(&parent_port->dev) operates\non freed memory. The kernel log looks same as above, with a different\noffset in cxl_detach_ep().\n\nBoth of these issues stem from the absence of a lifetime guarantee\nbetween a child port and its parent port.\n\nEstablish a lifetime rule for ports: child ports hold a reference to\ntheir parent device until release. Take the reference when the port\nis allocated and drop it when released. This ensures the parent is\nvalid for the full lifetime of the child and eliminates the use after\nfree window in cxl_detach_ep().\n\nThis is easily reproduced with a reload of cxl_acpi in QEMU with CXL\ndevices present."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncxl/port: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n de parent_port en cxl_detach_ep()\n\ncxl_detach_ep() es llamada durante la eliminaci\u00f3n de abajo hacia arriba cuando todos los dispositivos de memoria CXL debajo de un puerto de switch han sido eliminados. Para cada puerto en la jerarqu\u00eda, bloquea tanto el puerto como su padre, elimina el punto final, y si el puerto ahora est\u00e1 vac\u00edo, lo marca como muerto y anula el registro del puerto llamando a delete_switch_port(). Hay dos lugares durante este trabajo donde parent_port puede ser usado despu\u00e9s de su liberaci\u00f3n:\n\nPrimero, una desconexi\u00f3n concurrente puede haber procesado ya un puerto para cuando un segundo trabajador lo encuentra a trav\u00e9s de bus_find_device(). Sin fijar parent_port, puede que ya est\u00e9 liberado cuando descubrimos port -> dead e intentamos desbloquear parent_port. En un kernel de producci\u00f3n eso es una corrupci\u00f3n de memoria silenciosa, con depuraci\u00f3n de bloqueo, se ve as\u00ed:\n\nDEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())\nWARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310\nTraza de Llamada:\nmutex_unlock+0xd/0x20\ncxl_detach_ep+0x180/0x400 [cxl_core]\ndevm_action_release+0x10/0x20\ndevres_release_all+0xa8/0xe0\ndevice_unbind_cleanup+0xd/0xa0\nreally_probe+0x1a6/0x3e0\n\nSegundo, delete_switch_port() libera tres acciones devm registradas contra parent_port. La \u00faltima de ellas es unregister_port() y llama a device_unregister() en el puerto hijo, lo que puede generar una cascada. Si parent_port ahora tambi\u00e9n est\u00e1 vac\u00edo el n\u00facleo del dispositivo puede anular su registro y liberarlo tambi\u00e9n. As\u00ed que para cuando delete_switch_port() regresa, parent_port puede estar libre, y el subsiguiente device_unlock(ref:parent_port -> dev) opera sobre memoria liberada. El registro del kernel se ve igual que el anterior, con un desplazamiento diferente en cxl_detach_ep().\n\nAmbos de estos problemas provienen de la ausencia de una garant\u00eda de vida \u00fatil entre un puerto hijo y su puerto padre.\n\nEstablecer una regla de vida \u00fatil para los puertos: los puertos hijos mantienen una referencia a su dispositivo padre hasta su liberaci\u00f3n. Tomar la referencia cuando el puerto es asignado y soltarla cuando es liberado. Esto asegura que el padre sea v\u00e1lido durante toda la vida \u00fatil del hijo y elimina la ventana de uso despu\u00e9s de liberaci\u00f3n en cxl_detach_ep().\n\nEsto se reproduce f\u00e1cilmente con una recarga de cxl_acpi en QEMU con dispositivos CXL presentes."}], "id": "CVE-2026-31530", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31530", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:37:47.922657Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:53.293", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2c32141462045cf93d54a5146a0ba572b83533dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1f62588ab1be6c9535d74348003c86b47ec4abd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d216a4bd138eb57cc4ae7c43b2f709e3482af7e2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7dc6f381a1e5f068333f1faa9265d6af1df4235"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep()", "id": "2460644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460644"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-31530", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31530\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31530\nhttps://lore.kernel.org/linux-cve-announce/2026042215-CVE-2026-31530-b6f5@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2345df54249c6fb7779e2a72b427ee79ed3eaad5,d216a4bd138eb57cc4ae7c43b2f709e3482af7e2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2345df54249c6fb7779e2a72b427ee79ed3eaad5,2c32141462045cf93d54a5146a0ba572b83533dd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2345df54249c6fb7779e2a72b427ee79ed3eaad5,f7dc6f381a1e5f068333f1faa9265d6af1df4235)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2345df54249c6fb7779e2a72b427ee79ed3eaad5,19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.80,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T23:55:05.735975+00:00", "value": {"mitigation_remediation": ["Apply a kernel patch that restores a reference from child to parent CXL ports and removes the use\u2011after\u2011free condition", "If a patch cannot be applied immediately, disable the cxl_acpi module or remove any CXL devices from the system until the kernel update is available", "Enable lock debugging or run the kernel with debugging subsystems enabled to capture any remaining deadlock or unlock violations during CXL operations"], "summary": {"action": "Patch Update", "impact": "Use\u2011After\u2011Free causing silent memory corruption of kernel data structures"}, "threat_synthesis": {"affected_systems": "All Linux kernels that load the cxl_acpi driver with CXL memory devices are affected. This includes every Linux kernel version that supports CXL devices (e.g., the 7.0 release candidates and older releases). Systems that never use CXL hardware or never load the relevant driver are not impacted.", "description_and_impact": "This flaw is a classic Use\u2011After\u2011Free caused by the removal routine for CXL memory devices in the Linux kernel. During bottom\u2011up detachment, child ports are unlocked and unregistered while their parent ports may have already been freed. The kernel then attempts to unlock or unregister already\u2011freed memory, producing lock warnings and corrupting kernel structures. The corruption can lead to kernel crashes or data integrity issues but does not provide a direct path for remote code execution.", "risk_and_exploitability": "The CVSS score of 7.8 indicates medium\u2011high severity. The EPSS score is <1%, meaning exploitation is unlikely in the wild, and the flaw is not listed in CISA\u2019s KEV catalog. The likely attack vector is local, requiring privileged or root access to trigger the module reload or device removal that would exercise the vulnerable code. As such, the risk to unprivileged or non\u2011CXL\u2011enabled systems is low, but the corruption can cause denial of service if the flaw is activated on a vulnerable system."}}}}, "created": "2026-04-22T20:15:20.260286+00:00", "updated": "2026-04-29T00:00:13.837381+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}