CVE-2025-38252

In the Linux kernel, the following vulnerability has been resolved:

cxl/ras: Fix CPER handler device confusion

By inspection, cxl_cper_handle_prot_err() is making a series of fragile assumptions that can lead to crashes:

1/ It assumes that endpoints identified in the record are a CXL-type-3 device, nothing guarantees that.

2/ It assumes that the device is bound to the cxl_pci driver, nothing guarantees that.

3/ Minor, it holds the device lock over the switch-port tracing for no reason as the trace is 100% generated from data in the record.

Correct those by checking that the PCIe endpoint parents a cxl_memdev before assuming the format of the driver data, and move the lock to where it is required. Consequently this also makes the implementation ready for CXL accelerators that are not bound to cxl_pci.

This flaw does not affect supported Red Hat Enterprise Linux releases because the vulnerable CXL handling code is not present in Red Hat kernels. In affected upstream environments, the issue poses a denial of service risk where unexpected protocol error records on systems equipped with Compute Express Link hardware can trigger a kernel crash. Triggering this condition requires specialized CXL accelerator devices and the generation of Common Platform Error Records.