CVE-2026-74273
Description
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regions_lock", to disable region deletion in the critical period between construct_region() and attach_target(), as well as the period between device_add() and registering the remove actions. Otherwise, userspace can confuse the kernel. It can violate the assumption the region stays registered through the completion of cxl_add_to_region(). It can violate the assumption that devm_add_action_or_reset() is working with a live 'struct cxl_region'. It is ok for the region to disappear outside of those windows as that mirrors device hotplug flows where the proper locks are held.
How to fix
- Linux Linux8efa9fcc1d31b29b31e0ac4efe48624a729796bc, ecc86a28dc27509da511bb3f8c309750233e3177, 98c7e206af48b4433b2192cc1a538db2acc49876, b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8, d91feb88692e81b00cd22f0125cfcd04970b4a0b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a32320b71f085f8d82afedcf285f1682c8c00aed ≤ v < 8efa9fcc1d31b29b31e0ac4efe48624a729796bc, a32320b71f085f8d82afedcf285f1682c8c00aed ≤ v < ecc86a28dc27509da511bb3f8c309750233e3177, a32320b71f085f8d82afedcf285f1682c8c00aed ≤ v < 98c7e206af48b4433b2192cc1a538db2acc49876, a32320b71f085f8d82afedcf285f1682c8c00aed ≤ v < b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8, a32320b71f085f8d82afedcf285f1682c8c00aed ≤ v < d91feb88692e81b00cd22f0125cfcd04970b4a0b, 6.3 | 8efa9fcc1d31b29b31e0ac4efe48624a729796bc, ecc86a28dc27509da511bb3f8c309750233e3177, 98c7e206af48b4433b2192cc1a538db2acc49876, b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8, d91feb88692e81b00cd22f0125cfcd04970b4a0b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.