EUVD-2026-76481
GHSA-5c9g-7vf9-4pwc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between device teardown and MCE interrupt plus mandatory CXL extended-linear-cache hardware configuration justifies AC:H over the vendor's AC:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
cxl/mce: Make the MCE notifier per-region
Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size).
Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage.
Remove cxl_port_get_spa_cache_alias() as it is now dead code.
[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]
AnalysisAI
NULL pointer dereference and use-after-free conditions in the Linux kernel's CXL (Compute Express Link) MCE notifier path allow a local attacker with low privileges to corrupt kernel memory or achieve privilege escalation on systems with CXL memory hardware and extended linear cache enabled. The notifier was incorrectly anchored to the memory device lifetime (cxl_memdev_state) rather than to the region lifetime (cxl_region), meaning the MCE interrupt handler could fire against freed or nulled objects during device or region teardown. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all four conditions simultaneously: (1) a Linux kernel in the affected commit range (post-516e5bd0b6bf4ae1ad072df637b428a737c3c870, pre-fix) running on the system, (2) physical or emulated CXL (Compute Express Link) memory hardware present and recognized by the kernel, (3) at least one CXL memory region with the extended linear cache feature enabled - without this, the vulnerable notifier is never registered and the code path is never reached, and (4) local access with at least low-privilege credentials (CVSS PR:L) sufficient to trigger or race CXL device/region lifecycle transitions concurrent with MCE delivery. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N scores 7.8, which correctly identifies local access and low-privilege requirements but likely overstates AC:L - the vulnerability involves a race condition between device teardown and MCE handler dispatch, and requires specific CXL hardware with extended linear cache configured, both of which push complexity upward. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to Linux 6.18.51, 7.2.4, or 7.3-rc1, which contain the fix relocating the MCE notifier into `struct cxl_region` with registration gated on extended linear cache presence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems with CXL memory hardware and extended linear cache enabled to quantify organizational exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today