CVE-2026-31530

In the Linux kernel, the following vulnerability has been resolved:

cxl/port: Fix use after free of parentport in cxldetach_ep()

cxldetachep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by calling deleteswitchport(). There are two places during this work where the parent_port may be used after freeing:

First, a concurrent detach may have already processed a port by the time a second worker finds it via busfinddevice(). Without pinning parentport, it may already be freed when we discover port->dead and attempt to unlock the parentport. In a production kernel that's a silent memory corruption, with lock debug, it looks like this:

[]DEBUGLOCKSWARN_ON(__ownertask(owner) != getcurrent()) []WARNING: kernel/locking/mutex.c:949 at _mutexunlockslowpath+0x1ee/0x310 []Call Trace: []mutexunlock+0xd/0x20 []cxldetachep+0x180/0x400 [cxlcore] []devmactionrelease+0x10/0x20 []devresreleaseall+0xa8/0xe0 []deviceunbindcleanup+0xd/0xa0 []reallyprobe+0x1a6/0x3e0

Second, deleteswitchport() releases three devm actions registered against parentport. The last of those is unregisterport() and it calls deviceunregister() on the child port, which can cascade. If parentport is now also empty the device core may unregister and free it too. So by the time deleteswitchport() returns, parentport may be free, and the subsequent deviceunlock(&parentport->dev) operates on freed memory. The kernel log looks same as above, with a different offset in cxldetach_ep().

Both of these issues stem from the absence of a lifetime guarantee between a child port and its parent port.

Establish a lifetime rule for ports: child ports hold a reference to their parent device until release. Take the reference when the port is allocated and drop it when released. This ensures the parent is valid for the full lifetime of the child and eliminates the use after free window in cxldetachep().

This is easily reproduced with a reload of cxl_acpi in QEMU with CXL devices present.