Executive brief
The Linux kernel's CXL (Compute Express Link) memory subsystem had a use-after-free vulnerability in its machine-check exception (MCE) notifier. The notifier was incorrectly attached to individual memory devices rather than memory regions, causing NULL pointer dereferences or crashes when devices were removed while the system was processing hardware errors. This could lead to kernel instability or denial of service in systems using CXL memory.
Technical details
The vulnerability is a use-after-free in the CXL MCE notifier handler caused by improper lifetime management. The notifier was registered per memory device in 'struct cxl_memdev_state' but only required per-region data (region SPA range and extended linear cache size). When a memory device was removed or unprobed, the notifier remained registered but pointed to freed memory, causing NULL dereferences or use-after-free when machine-check exceptions occurred. The fix moved the notifier registration from device-level (cxl_memdev_state_create) to region-level (cxl_region_probe), ensuring the notifier lifetime matches the region's lifecycle. This prevents accessing freed memory during MCE handling.
Affected products
- Linux Linux kernel versions with CXL MCE notifier support (5.20+)
Timeline
- 2026-09-11: disclosed: CVE-2026-89570 published
- 2026-06-16: patched: Fix committed by Dave Jiang