Use-After-Free Vulnerability in Linux Kernel Affecting CXL Devices

CVE-2026-31530

What is CVE-2026-31530?

A use-after-free vulnerability exists in the Linux kernel related to CXL (Compute Express Link) memory devices. The issue occurs in the cxl_detach_ep() function during the bottom-up removal process, potentially leading to memory corruption. This situation arises when the parent port of a detached endpoint can be accessed after it has already been freed. Without proper reference management, concurrent detachments can cause a scenario where a freed parent port is improperly accessed, resulting in silent memory corruption in production environments. Developers are advised to implement a lifetime rule ensuring child ports hold references to their parent devices throughout their lifecycle, thereby preventing such vulnerabilities.

References