CVE-2024-50226

Summary

CVE-2024-50226 is a vulnerability in the Linux kernel's CXL (Compute Express Link) driver. It involves a use-after-free issue caused by an out-of-order decoder shutdown. During the teardown process, if a switch-decoder is removed before its dependent endpoints are disabled, it can lead to a stale decoder object being referenced, resulting in a kernel crash. The fix for this issue is to ensure that decoders are always removed in the correct order, and failures during CXL region destruction are now turned into warnings instead of crashes. A new function, device_for_each_child_reverse_from(), has been added to facilitate proper decoder teardown.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.