CVE-2024-58093: PCI/ASPM: Fix link state exit during switch upstream function removal

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-16 · updated 2026-07-16
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed. That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after. After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link. That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports. The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order. On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone. [kwilczynski: commit log]

Affected products

Linux kernel: from 5.4.251 before 5.5; from 5.10.188 before 5.11; from 5.15.121 before 5.16; from 6.1.39 before 6.2; from 6.3.13 before 6.4; from 6.4.4 before 6.15 — fixed in 5.11, 5.16, 5.5, 6.15, 6.2, 6.4

How to fix

Upgrade to a fixed version: Linux kernel 5.11, 5.16, 5.5, 6.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-58093 or the next vulnerability affects your stack