CVE-2022-49895

In the Linux kernel, the following vulnerability has been resolved:

cxl/region: Fix decoder allocation crash

When an intermediate port's decoders have been exhausted by existing regions, and creating a new region with the port in question in it's hierarchical path is attempted, cxl_port_attach_region() fails to find a port decoder (as would be expected), and drops into the failure / cleanup path.

However, during cleanup of the region reference, a sanity check attempts to dereference the decoder, which in the above case didn't exist. This causes a NULL pointer dereference BUG.

To fix this, refactor the decoder allocation and de-allocation into helper routines, and in this 'free' routine, check that the decoder, @cxld, is valid before attempting any operations on it.

The patch fixes a NULL-pointer dereference in the CXL region code: when an intermediate port has no free decoders, cleanup could still dereference a non-allocated decoder during region attach error handling, leading to a kernel BUG/panic. Exploitation requires privileged control over CXL region/decoder configuration (e.g., via ndctl/cxl tooling). A local admin could reliably trigger a DoS by exhausting decoders and attempting region creation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.