Executive brief
The Linux kernel's CXL (Compute Express Link) region driver incorrectly uses an array index that can be set to a negative error code, causing an out-of-bounds memory access. This affects systems using CXL memory hardware. An attacker with local access could trigger the error condition and crash the kernel or potentially execute arbitrary code.
Technical details
The vulnerability is an out-of-bounds array access in the cxl_cancel_auto_attach() function within drivers/cxl/core/region.c. The root cause is that cxled->pos is assumed to be a valid array index for p->targets[], but cxl_region_sort_targets() can set cxled->pos to a negative errno value when cxl_calc_interleave_pos() fails. The function then attempts array access using this negative index, resulting in out-of-bounds memory access. The fix changes the implementation to iterate through the p->targets[] array directly rather than using cxled->pos as an index. No special privileges or network access are required; the vulnerability can be triggered locally during CXL region management operations. A patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Affected versions include at least Linux 5.x, 6.x, and 7.x; precise affected range not fully specified in advisory
Timeline
- 2026-08-15: disclosed
- 2026-06-12: patched: Upstream fix committed; stable tree backport dated 2026-07-24