CVE-2026-89589: Linux Kernel CXL CPER Race Condition Vulnerability

CVE-2026-89589 Overview

CVE-2026-89589 is a Linux kernel concurrency defect in the ACPI APEI GHES subsystem. The flaw affects the Compute Express Link (CXL) Common Platform Error Record (CPER) work registration and unregistration helpers. These helpers acquire cxl_cper_work_lock and cxl_cper_prot_err_work_lock using a spinlock guard that leaves local interrupts enabled. The corresponding post paths, cxl_cper_post_event() and cxl_cper_post_prot_err(), execute in hard IRQ context from the GHES error notification path. When both paths contend on the same CPU, the kernel can deadlock.

Critical Impact
A CPU holding the spinlock can be preempted by a GHES interrupt that spins waiting for the same lock, producing a hard deadlock on affected systems using CXL error reporting.

Affected Products

Linux kernel versions containing the CXL CPER work registration code in drivers/acpi/apei/ghes.c
Systems using Compute Express Link (CXL) hardware with GHES error reporting enabled
PREEMPT_RT kernel builds where spinlock_t is backed by rt_mutex

Discovery Timeline

2026-09-11 - CVE-2026-89589 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89589

Vulnerability Analysis

The defect is a classic locking discipline violation in the CXL CPER path of the ACPI APEI GHES driver. Registration and unregistration helpers acquire the work locks with a plain spinlock guard that does not disable local interrupts. The post-event handlers, invoked from the GHES notification path in hard IRQ context, acquire the same locks with an irqsave guard. When a GHES interrupt fires on a CPU that already holds one of these locks, the interrupt handler spins waiting for the release, while the lock holder cannot make progress because it was preempted by that same interrupt. The result is a self-deadlock on that CPU.

The patch also addresses a secondary use-after-free window in the unregister path, where a CPER interrupt could schedule work on a pointer being freed. Both kfifo structures are single-consumer, and stale entries could be replayed on next module load without an explicit reset.

Root Cause

The root cause is inconsistent interrupt masking between two code paths that share the same locks. Callers in process context used spinlock_t with interrupts enabled, while IRQ-context callers used the irqsave variant. This mismatch is unsafe on any system where the process-context holder can be interrupted on the same CPU as the IRQ handler. On PREEMPT_RT kernels, the issue is compounded because spinlock_t becomes an rt_mutex that can sleep, which is forbidden in hard IRQ context.

Attack Vector

This is a reliability and availability defect rather than a remotely exploitable memory corruption. Triggering the deadlock requires the GHES error notification path to fire while the CXL CPER work registration or unregistration helpers hold the lock on the same CPU. Exploitation would generally require local privilege to load or unload the CXL modules, combined with hardware conditions that generate CXL CPER events. The primary impact is denial of service through a hung CPU or hung kernel task.

No public proof-of-concept exists. The fix in the mainline tree converts both locks from spinlock_t to raw_spinlock_t, uses guard() at every call site, adds WARN_ONCE to detect double registration, clears the global work pointer under the lock before cancel_work_sync(), and calls kfifo_reset() to drain stale entries. See the Kernel.org commit note for the exact source-level changes.

Detection Methods for CVE-2026-89589

Indicators of Compromise

Hung task warnings referencing cxl_cper_post_event or cxl_cper_post_prot_err in kernel logs
Soft lockup or RCU stall reports on CPUs handling GHES notifications
Kernel panics or unresponsive CPUs following CXL error injection or hardware CXL events
Presence of unpatched cxl_cper_work_lock or cxl_cper_prot_err_work_lock symbols using spinlock_t in the running kernel

Detection Strategies

Inventory Linux hosts and identify kernels containing the vulnerable CXL CPER work registration code prior to the mainline fix
Correlate dmesg output for lockdep splats, spinlock recursion warnings, or GHES-related stack traces
On PREEMPT_RT systems, monitor for BUG messages about sleeping from invalid context in the GHES notification path

Monitoring Recommendations

Enable CONFIG_PROVE_LOCKING and CONFIG_DEBUG_ATOMIC_SLEEP in test kernels to surface locking violations during CXL error injection tests
Forward kernel logs and hung task warnings to a centralized log platform for correlation across the fleet
Track kernel package versions in configuration management to identify hosts running versions predating the fix

How to Mitigate CVE-2026-89589

Immediate Actions Required

Identify all Linux hosts running kernels with the CXL CPER work code and CXL hardware present
Apply the stable kernel updates that convert cxl_cper_work_lock and cxl_cper_prot_err_work_lock to raw_spinlock_t
Prioritize PREEMPT_RT systems and hosts with production CXL memory or accelerators, where the deadlock impact is most severe

Patch Information

The fix has been merged upstream and backported to stable branches. Refer to the following commits for the authoritative patch content:

The patch also removes the redundant cancel_work_sync() calls from cxl_ras_exit() and cxl_pci_driver_exit() because the CPER unregister functions now quiesce work internally.

Workarounds

Where patching is not immediately possible, avoid dynamic load and unload of CXL modules on running systems to reduce the window in which the registration and unregistration helpers execute
Disable CXL error reporting through GHES if it is not required by the platform and the vendor supports doing so
On PREEMPT_RT deployments, defer CXL enablement until patched kernels are installed

bash

# Verify the running kernel version and check for CXL CPER symbols
uname -r
grep -E 'cxl_cper_work_lock|cxl_cper_prot_err_work_lock' /proc/kallsyms

# Apply distribution kernel updates (example for Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)
sudo reboot