CVE-2026-74275 (GCVE-0-2026-74275)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach() In cxl_cancel_auto_attach(), it assumes cxled->pos is a valid index for accessing p->targets[]. However, cxled->pos can be set to negative errno in cxl_region_sort_targets() if cxl_calc_interleave_pos() fails. This causes the driver to use a negative index to access p->targets[], resulting in out-of-bounds access. Fix it by walking p->targets[] instead of using cxled->pos directly.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 87805c32e6ad7b5ce2d9f7f47e76081857a4a335 , < 44b2397eb67b7f728640989a22d062e41f94ab64 (git)
Affected: 87805c32e6ad7b5ce2d9f7f47e76081857a4a335 , < cbda6a2c2bec2a5fb30a2ce85baeab15b5fc7db3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/region.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44b2397eb67b7f728640989a22d062e41f94ab64",
              "status": "affected",
              "version": "87805c32e6ad7b5ce2d9f7f47e76081857a4a335",
              "versionType": "git"
            },
            {
              "lessThan": "cbda6a2c2bec2a5fb30a2ce85baeab15b5fc7db3",
              "status": "affected",
              "version": "87805c32e6ad7b5ce2d9f7f47e76081857a4a335",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/region.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()\n\nIn cxl_cancel_auto_attach(), it assumes cxled-\u003epos is a valid index for\naccessing p-\u003etargets[]. However, cxled-\u003epos can be set to negative errno\nin cxl_region_sort_targets() if cxl_calc_interleave_pos() fails. This\ncauses the driver to use a negative index to access p-\u003etargets[],\nresulting in out-of-bounds access.\n\nFix it by walking p-\u003etargets[] instead of using cxled-\u003epos directly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the CXL region driver reached via local kernel paths\u2014CXL endpoint decoder auto-discovery/attach, sysfs region/target management under /sys/bus/cxl/, and PCI/CXL device removal\u2014not via any network protocol or remote packet handler.\nAC:L - Once CXL auto-region assembly fails in cxl_region_sort_targets() leaving a decoder AUTO_STAGED with a negative cxled-\u003epos, an attacker who can present or remove CXL endpoints can reliably trigger cxl_cancel_auto_attach() during decoder teardown without uncontrollable timing or memory-layout dependencies.\nPR:N - The vulnerable teardown path runs automatically during kernel-driven CXL endpoint decoder unregistration after failed auto-assembly; it does not require authenticated access or elevated credentials, only that a CXL topology causes cxl_calc_interleave_pos() to fail before the decoder is removed.\nUI:N - Exploitation requires no end-user interaction such as opening files or mounting filesystems; it is triggered by kernel CXL auto-discovery, region assembly failure, and subsequent endpoint decoder detach/unregister events.\nS:U - The out-of-bounds access corrupts kernel cxl_region_params memory within the same kernel security boundary and does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - cxl_region_by_target() performs an out-of-bounds read using the negative cxled-\u003epos as an index into p-\u003etargets[], leaking adjacent kernel memory from the cxl_region_params structure before the array base.\nI:H - cxl_cancel_auto_attach() writes NULL via p-\u003etargets[pos] using the same negative index, corrupting adjacent fields such as the region resource pointer and other cxl_region_params metadata exploitable for further memory corruption.\nA:H - Out-of-bounds access and corruption of critical region metadata pointers can cause kernel oops, panic, or hang during CXL region teardown on systems with CONFIG_CXL_REGION and interleaved CXL memory expanders."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:17.863Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44b2397eb67b7f728640989a22d062e41f94ab64"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbda6a2c2bec2a5fb30a2ce85baeab15b5fc7db3"
        }
      ],
      "title": "cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74275",
    "datePublished": "2026-08-15T05:57:47.455Z",
    "dateReserved": "2026-08-15T05:44:03.879Z",
    "dateUpdated": "2026-08-17T05:45:17.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74275",
      "date": "2026-09-21",
      "epss": "0.00131",
      "percentile": "0.03078"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/cxl/core/region.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "44b2397eb67b7f728640989a22d062e41f94ab64",
                    "status": "affected",
                    "version": "87805c32e6ad7b5ce2d9f7f47e76081857a4a335",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cbda6a2c2bec2a5fb30a2ce85baeab15b5fc7db3",
                    "status": "affected",
                    "version": "87805c32e6ad7b5ce2d9f7f47e76081857a4a335",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/cxl/core/region.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()\n\nIn cxl_cancel_auto_attach(), it assumes cxled-\u003epos is a valid index for\naccessing p-\u003etargets[]. However, cxled-\u003epos can be set to negative errno\nin cxl_region_sort_targets() if cxl_calc_interleave_pos() fails. This\ncauses the driver to use a negative index to access p-\u003etargets[],\nresulting in out-of-bounds access.\n\nFix it by walking p-\u003etargets[] instead of using cxled-\u003epos directly."
          }
        ],
        "id": "CVE-2026-74275",
        "lastModified": "2026-08-17T06:19:21.187",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:26.897",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/44b2397eb67b7f728640989a22d062e41f94ab64"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cbda6a2c2bec2a5fb30a2ce85baeab15b5fc7db3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T15:04:26+00:00",
      "cve": "CVE-2026-74275",
      "id": "CVE-2026-74275",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74275.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.