CVE-2026-89589

In the Linux kernel, the following vulnerability has been resolved:

acpi/apei/ghes: Use raw spinlock t for CXL CPER work locks

The CXL CPER work registration and unregistration helpers acquire cxl cper work lock and cxl cper prot err work lock with a spinlock guard(), which leaves local interrupts enabled. The corresponding post paths (cxl cper post event(), cxl cper post prot err()) execute in hard IRQ context (they are called from the GHES error notification path) and acquire the same locks with an irqsave guard().

If a CPU is holding one of these locks via a spinlock guard() when a GHES interrupt arrives on the same CPU, the IRQ handler spins on the held lock waiting for it to release, while the lock holder is preempted by the IRQ. The result is a deadlock.

Convert both locks from spinlock t to raw spinlock t and use guard() at all call sites. On PREEMPT RT kernels spinlock t is backed by rt mutex and sleeping from hard IRQ context is not permitted; raw spinlock t is safe in both contexts.

Add WARN ONCE to both register functions to surface double-registration bugs at runtime.

Restructure both unregister functions to clear the global work pointer under the lock before calling cancel work sync(), closing the window where a CPER interrupt could schedule work on a pointer about to be freed. Add kfifo reset() after cancel work sync() so stale entries are not replayed on next module load.

Both kfifos are single-consumer: only one work struct is registered at a time, enforced by the WARN ONCE guard in the register functions. kfifo reset() is safe outside the lock because cancel work sync() has already quiesced the consumer, and no new consumer can register until the current module exit completes and a fresh module init runs.

Remove the redundant cancel work sync() call from cxl ras exit() and cxl pci driver exit(). The CPER unregister functions now quiesce the work internally.