Linux Kernel CVE-2026-74275

Exploitation requires: (1) physical CXL-capable hardware installed in the target system, including a CXL-compatible CPU and CXL memory device - systems without CXL hardware are completely unaffected regardless of kernel version; (2) the cxl_region kernel module loaded and active; (3) a condition where cxl_calc_interleave_pos() returns an error during region interleave target sorting, causing cxl_region_sort_targets() to store a negative errno in cxled->pos; (4) subsequent invocation of cxl_cancel_auto_attach() on the affected cxled object. The provided CVSS PR:N implies no privilege requirement, but CXL region management operations and kernel driver interactions on Linux realistically require CAP_SYS_ADMIN or equivalent - this limiting factor is not captured in the NVD vector. Non-default configuration: the specific error path in cxl_calc_interleave_pos() must be reachable, which depends on the CXL device topology and interleave configuration parameters.

The provided CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 8.4, reflecting a local exploitation scenario with full confidentiality, integrity, and availability impact. The PR:N rating is questionable: CXL kernel driver interactions and region management operations in practice typically require CAP_SYS_ADMIN or root - not zero privileges - making PR:L a more defensible independent assessment. EPSS at 0.15% (5th percentile) strongly suggests low attacker interest and no known exploitation tooling, consistent with the absence of any KEV listing or public POC. The real-world risk is substantially below what the CVSS score implies due to three compounding constraints: physical presence of CXL-capable hardware (a minority of even enterprise deployments), the specific failure path through cxl_calc_interleave_pos() being required, and the kernel-driver attack surface being accessible only to privileged local actors in most configurations. Cloud VMs, commodity servers, and embedded devices are almost universally unaffected. This is a high-CVSS-but-low-real-risk issue for the vast majority of environments - prioritize patching only on systems confirmed to have CXL memory hardware.

A local attacker with access to a CXL-equipped server triggers a CXL region configuration sequence in which cxl_calc_interleave_pos() returns an error, causing cxl_region_sort_targets() to write a negative errno into cxled->pos. When the kernel subsequently calls cxl_cancel_auto_attach(), it uses that negative value as an array index into p->targets[], dereferencing kernel memory before the array's base address. Depending on kernel layout, this could crash the system or corrupt adjacent data structures, potentially enabling privilege escalation. No public proof-of-concept exists, and reproducing this requires both CXL hardware and deep kernel subsystem knowledge.