CVE-2024-41085 is a vulnerability in the Linux kernel's CXL memory subsystem where a null pointer dereference occurs during the auto-assembling of a pmem region in the cxl endpoint port probing process. The root cause is that the cxl_nvd device is registered after the endpoint port probe, but the pmem region probe requires it to be available earlier. This leads to a kernel NULL pointer dereference and a crash. The fix involves changing the probe sequence and adding a port parameter to cxl_find_nvdimm_bridge() to query the ancestor root port, ensuring the dependency is met before the pmem region probe.

The vulnerability causes a kernel NULL pointer dereference resulting in a kernel crash (denial of service) when the CXL subsystem auto-assembles a pmem region. There is no indication of confidentiality or integrity impact.

A fix has been implemented in the Linux kernel to adjust the probe sequence so that the cxl_nvd device is available during the pmem region probe. Users should apply the official kernel update containing this fix once available. Patch status is not explicitly confirmed in the input; check the vendor advisory for the current remediation guidance.