CVE-2026-74274 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Fill first free targets[] slot during auto-discovery
Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p->nr_targets entries of the target array in an auto-assembly region are valid. However, there are scenarios that could leave NULL endpoint decoder pointer holes in the target array.
1. When cxl_cancel_auto_attach() removes an endpoint decoder from a target array, the target slot is set to NULL. If the removed endpoint decoder is not the last element in the target array, the target array will contain a NULL hole.
2. When a auto-assembly region removes an assigned endpoint decoder, if the removed endpoint decoder is not the last element in the target array, always remains a NULL hole in the target array.
When a NULL pointer hole exists in a region's target array, it introduces two potential problems: 1. Access an endpoint decoder via a NULL pointer. it always trigger calltrace like that. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
RIP: 0010:cxl_calc_interleave_pos+0x26/0x810 [cxl_core]
Call Trace: <TASK> cxl_region_attach+0xc50/0x2140 [cxl_core]
cxl_add_to_region+0x321/0x2330 [cxl_core]
discover_region+0x92/0x150 [cxl_port]
device_for_each_child+0xf3/0x170 cxl_port_probe+0x150/0x200 [cxl_port]
cxl_bus_probe+0x4f/0xa0 [cxl_core]
really_probe+0x1c8/0x960 __driver_probe_device+0x323/0x450 driver_probe_device+0x45/0x120 __device_attach_driver+0x15d/0x280 bus_for_each_drv+0x10f/0x190
2. Not having enough valid endpoint decoders attached to an auto-assembly region. if an auto-assembly region is created with lock flag or assigned endpoint decoder with lock flag, which means assigned endpoint decoder will not be reset during detaching, they could re-attach to the auto-assembly region again. But cxl region driver relies on p->nr_targets to verify whether the required number of endpoint decoders has been attached, and NULL endpoint decoder pointers are still counted in that case.
To fix above issues, adjust cxl_region_attach_auto() logic to find the first free target slot for endpoint decoder attachment, this ensures NULL holes in the target array are filled, rather than adding new endpoint decoders at the tail of the target array.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described involves a critical flaw in the Linux kernel's CXL (Compute Express Link) driver implementation that affects how auto-assembly regions manage endpoint decoder targets. This issue stems from improper handling of NULL pointer holes within the target array structure, creating both immediate operational failures and potential security implications. The problem occurs specifically within the cxl/region subsystem where the driver assumes contiguous valid entries in the target array, but fails to properly maintain this assumption when endpoints are removed or reattached.
The technical root cause lies in how the cxl driver handles endpoint decoder removal operations through functions like cxl_cancel_auto_attach() and auto-assembly region management. When endpoint decoders are removed from a region's target array, the system sets the corresponding target slot to NULL rather than compacting the array elements. This creates gaps or holes in the target array that persist even after subsequent attachment operations. The driver's logic for determining available slots relies on sequential iteration through the target array, failing to recognize these NULL entries as valid free slots for new endpoint attachments.
The operational impact of this vulnerability manifests in two primary failure modes that can lead to system instability and potential denial of service conditions. First, direct access to NULL endpoint decoder pointers triggers kernel oops conditions with general protection faults, typically resulting in kernel panic scenarios that require system reboot. The call trace demonstrates the execution path leading to these failures through cxl_calc_interleave_pos function, which attempts to dereference invalid pointers during region attachment operations. Second, the driver's validation logic becomes fundamentally flawed when counting endpoint decoders against required target counts, as NULL entries are still included in the p->nr_targets calculation, potentially preventing proper region assembly even when sufficient valid endpoints exist.
This vulnerability maps directly to CWE-476 which describes "NULL Pointer Dereference" and also relates to CWE-125 "Out-of-bounds Read" through improper array boundary handling. From an ATT&CK perspective, this represents a privilege escalation vector through kernel exploitation, potentially enabling adversaries to achieve system compromise via denial of service or information disclosure attacks. The issue affects the CXL subsystem's core functionality and demonstrates poor resource management practices in kernel space device drivers where memory layout assumptions are not properly maintained during dynamic attachment operations.
The fix implemented addresses these issues by modifying the cxl_region_attach_auto() function logic to actively search for the first available free slot within the target array rather than simply appending new endpoint decoders at the end. This approach ensures that any existing NULL holes in the target array are properly filled, maintaining the driver's assumption of contiguous valid entries while preserving the integrity of the auto-assembly region management. The solution prevents both immediate kernel crashes from NULL pointer dereferences and logical errors in endpoint decoder counting that could lead to incomplete or malformed region configurations. This remediation maintains backward compatibility while strengthening the driver's robustness against dynamic attachment scenarios that previously led to inconsistent internal state management.
The vulnerability highlights critical security implications for systems relying on CXL device management, particularly in high-performance computing environments where reliable memory subsystem operation is essential. Proper array boundary handling and resource cleanup practices are fundamental requirements for kernel drivers to prevent both functional failures and potential exploitation vectors. The fix ensures that auto-assembly regions maintain consistent internal state regardless of dynamic attachment patterns, making the system more resilient against unexpected removal and reattachment sequences that could previously corrupt region configuration data structures.