Linux Kernel EUVD-2026-38910

Exploitation requires three concurrent conditions: (1) the target kernel must be built from a version between commit 858ce2f56b5253063f61f6b1c58a6dbf5d71da0b and the respective fix commit for the active stable branch, (2) the system must have CXL PCIe memory expansion hardware present with the cxl_pci driver loaded - without CXL hardware the vulnerable code path is never reached, and (3) the attacker must be able to trigger CXL device removal, either via sysfs driver unbind (/sys/bus/pci/drivers/cxl_pci/unbind, which typically requires root or specific udev ACLs) or through physical hotplug. The CVSS PR:L rating reflects that standard local user access is formally required, but the actual sysfs unbind path may demand elevated privilege in practice - verify sysfs permissions in your specific deployment. The vulnerability is entirely absent on systems lacking CXL hardware, and it offers no confidentiality or integrity impact under any conditions.

Real-world risk is moderate and tightly scoped. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (5.5) is internally consistent: the attack is local, the ordering bug is deterministic (not probabilistic), low privilege suffices, and impact is purely availability - a kernel crash. EPSS at 0.17% (6th percentile) is consistent with no known exploitation and the narrow hardware prerequisite. The vulnerability is absent from CISA KEV, and no POC has been identified. The low EPSS and local-only vector make this a lower operational priority than a 5.5 CVSS score alone would imply. However, on systems where CXL memory expansion hardware is present and untrusted local users can trigger device hotplug or driver unbind via sysfs, the crash is reliable rather than probabilistic (AC:L is accurate). The impact ceiling is denial of service - there is no confidentiality or integrity exposure per CVSS, which is consistent with the described crash path. No conflicting signals identified in the available data.

An attacker with a local shell account on a server equipped with CXL memory expansion hardware boots an unpatched kernel, allowing cxl_pci_driver_init() to run before fwctl_init(). The attacker then triggers device removal - for example by writing to /sys/bus/pci/drivers/cxl_pci/unbind if permitted, or by initiating a hotplug event - causing device_del() to call klist_del() on the uninitialized knode_class, immediately crashing the kernel and denying service to all processes on the host. No public exploit code has been identified at time of analysis.