CXL-type-3 Device Vulnerability in Linux Kernel

CVE-2025-38252

What is CVE-2025-38252?

A vulnerability in the Linux kernel related to CXL-type-3 devices has been identified due to fragile assumptions within the cxl_cper_handle_prot_err() function. It incorrectly assumes that the endpoints identified in the record are CXL-type-3 devices and that they are bound to the cxl_pci driver. Additionally, the device lock is held unnecessarily during the switch-port tracing. These flaws may lead to system crashes, compromising system stability. Remediations involve strengthening checks to ensure the PCIe endpoint is associated with cxl_memdev before making such assumptions, thus enhancing the kernel’s resilience against faulty driver assumptions.

References