EUVD-2026-59422
GHSA-mxc8-68wc-4vvm
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CXL region management requires CAP_SYS_ADMIN or root in practice, making PR:L more accurate than the provided PR:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()
In cxl_cancel_auto_attach(), it assumes cxled->pos is a valid index for accessing p->targets[]. However, cxled->pos can be set to negative errno in cxl_region_sort_targets() if cxl_calc_interleave_pos() fails. This causes the driver to use a negative index to access p->targets[], resulting in out-of-bounds access.
Fix it by walking p->targets[] instead of using cxled->pos directly.
AnalysisAI
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) physical CXL-capable hardware installed in the target system, including a CXL-compatible CPU and CXL memory device - systems without CXL hardware are completely unaffected regardless of kernel version; (2) the cxl_region kernel module loaded and active; (3) a condition where cxl_calc_interleave_pos() returns an error during region interleave target sorting, causing cxl_region_sort_targets() to store a negative errno in cxled->pos; (4) subsequent invocation of cxl_cancel_auto_attach() on the affected cxled object. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 8.4, reflecting a local exploitation scenario with full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with access to a CXL-equipped server triggers a CXL region configuration sequence in which cxl_calc_interleave_pos() returns an error, causing cxl_region_sort_targets() to write a negative errno into cxled->pos. When the kernel subsequently calls cxl_cancel_auto_attach(), it uses that negative value as an array index into p->targets[], dereferencing kernel memory before the array's base address. … |
| Remediation | Upgrade to Linux kernel 7.1.5 or later in the 7.1 stable series, or to 7.2-rc1 or any subsequent release incorporating commits 44b2397eb67b7f728640989a22d062e41f94ab64 or cbda6a2c2bec2a5fb30a2ce85baeab15b5fc7db3 (see https://git.kernel.org/stable/c/44b2397eb67b7f728640989a22d062e41f94ab64). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems equipped with CXL memory hardware and obtain the available kernel patch from your Linux distribution vendor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today