{"id":"DEBIAN-CVE-2023-52849","details":"In the Linux kernel, the following vulnerability has been resolved:  cxl/mem: Fix shutdown order  Ira reports that removing cxl_mock_mem causes a crash with the following trace:   BUG: kernel NULL pointer dereference, address: 0000000000000044  [..]  RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core]  [..]  Call Trace:   \u003cTASK\u003e   cxl_region_detach+0xe8/0x210 [cxl_core]   cxl_decoder_kill_region+0x27/0x40 [cxl_core]   cxld_unregister+0x29/0x40 [cxl_core]   devres_release_all+0xb8/0x110   device_unbind_cleanup+0xe/0x70   device_release_driver_internal+0x1d2/0x210   bus_remove_device+0xd7/0x150   device_del+0x155/0x3e0   device_unregister+0x13/0x60   devm_release_action+0x4d/0x90   ? __pfx_unregister_port+0x10/0x10 [cxl_core]   delete_endpoint+0x121/0x130 [cxl_core]   devres_release_all+0xb8/0x110   device_unbind_cleanup+0xe/0x70   device_release_driver_internal+0x1d2/0x210   bus_remove_device+0xd7/0x150   device_del+0x155/0x3e0   ? lock_release+0x142/0x290   cdev_device_del+0x15/0x50   cxl_memdev_unregister+0x54/0x70 [cxl_core]  This crash is due to the clearing out the cxl_memdev's driver context (@cxlds) before the subsystem is done with it. This is ultimately due to the region(s), that this memdev is a member, being torn down and expecting to be able to de-reference @cxlds, like here:  static int cxl_region_decode_reset(struct cxl_region *cxlr, int count) ...                 if (cxlds-\u003ercd)                         goto endpoint_reset; ...  Fix it by keeping the driver context valid until memdev-device unregistration, and subsequently the entire stack of related dependencies, unwinds.","modified":"2026-09-15T09:03:02.240909503Z","published":"2024-05-21T16:15:22.023Z","upstream":["CVE-2023-52849"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-52849"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.64-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-52849.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-52849.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-52849.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}