Executive brief
The Linux kernel's Compute Express Link (CXL) memory region deletion code contained a race condition that could allow multiple deletion attempts or conflicts between user-initiated region deletion and kernel teardown. This could lead to system instability or resource leaks when managing CXL memory regions.
Technical details
This is a race condition in the CXL region management subsystem (drivers/cxl/core/region.c). The vulnerability exists in the sysfs region deletion path and kernel device teardown code, where multiple threads could attempt to delete the same region simultaneously, or userspace could race against devres_release_all() during kernel shutdown. The fix replaces a devres list with an xarray and ensures proper locking (regions_lock) is held over region lookup and deletion operations, and uses the root decoder unregistration event to clean up remaining regions atomically. No network access is required; exploitation requires local access and the ability to trigger region deletion via sysfs.
Affected products
- Linux Linux kernel Multiple versions from 2.6.11 through at least 6.9 (see reference to fixes commit 779dd20cfb56)
Timeline
- 2026-08-15: disclosed