CVE-2024-26761

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26761
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26761.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-26761
Downstream
Related
Published
2024-04-03T17:00:44.934Z
Modified
2025-11-28T02:35:05.025663Z
Summary
cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window
Details

In the Linux kernel, the following vulnerability has been resolved:

cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window

The Linux CXL subsystem is built on the assumption that HPA == SPA. That is, the host physical address (HPA) the HDM decoder registers are programmed with are system physical addresses (SPA).

During HDM decoder setup, the DVSEC CXL range registers (cxl-3.1, 8.1.3.8) are checked if the memory is enabled and the CXL range is in a HPA window that is described in a CFMWS structure of the CXL host bridge (cxl-3.1, 9.18.1.3).

Now, if the HPA is not an SPA, the CXL range does not match a CFMWS window and the CXL memory range will be disabled then. The HDM decoder stops working which causes system memory being disabled and further a system hang during HDM decoder initialization, typically when a CXL enabled kernel boots.

Prevent a system hang and do not disable the HDM decoder if the decoder's CXL range is not found in a CFMWS window.

Note the change only fixes a hardware hang, but does not implement HPA/SPA translation. Support for this can be added in a follow on patch series.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26761.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
34e37b4c432cd0f1842b352fde4b8878b4166888
Fixed
031217128990d7f0ab8c46db1afb3cf1e075fd29
Fixed
2cc1a530ab31c65b52daf3cb5d0883c8b614ea69
Fixed
3a3181a71935774bda2398451256d7441426420b
Fixed
0cab687205986491302cd2e440ef1d253031c221

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.19.0
Fixed
6.1.80
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.19
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.7