CVE-2026-74275 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()
In cxl_cancel_auto_attach(), it assumes cxled->pos is a valid index for accessing p->targets[]. However, cxled->pos can be set to negative errno
in cxl_region_sort_targets() if cxl_calc_interleave_pos() fails. This causes the driver to use a negative index to access p->targets[],
resulting in out-of-bounds access.
Fix it by walking p->targets[] instead of using cxled->pos directly.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's compute express link (cxl) subsystem, specifically within the region management functionality. This issue manifests as an out-of-bounds memory access condition that occurs during the cancellation of automatic attachment operations for cxl regions. The problem stems from improper validation of index values before array access operations, creating a potential vector for memory corruption and system instability.
The technical flaw resides in the cxl_cancel_auto_attach() function where the code makes an assumption about the validity of cxled->pos as a direct index into the p->targets[] array. This assumption proves incorrect when cxl_region_sort_targets() encounters failures during cxl_calc_interleave_pos() execution, causing cxled->pos to be set to negative errno values. When these invalid negative indices are subsequently used to access p->targets[], the kernel experiences out-of-bounds memory access patterns that can lead to arbitrary code execution or system crashes.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation and system compromise. Attackers could leverage this condition to manipulate kernel memory structures, bypass security controls, or cause denial of service conditions that affect the entire compute express link subsystem. The vulnerability is particularly concerning as it operates within kernel space where unauthorized access can lead to complete system compromise.
The fix implemented addresses this issue by modifying the traversal logic in cxl_cancel_auto_attach() to iterate through p->targets[] using proper loop constructs rather than relying on the potentially invalid cxled->pos index directly. This approach eliminates the direct index usage and ensures that array bounds are properly respected during memory access operations. The mitigation strategy aligns with common secure coding practices and follows principles outlined in CWE-129 and CWE-787, which address improper bounds checking and out-of-bounds reads.
This vulnerability demonstrates the critical importance of validating all input parameters before using them as array indices, particularly within kernel drivers where such flaws can have catastrophic consequences. The fix represents a defensive programming approach that prevents the exploitation of uninitialized or improperly validated data structures, reducing the attack surface for potential adversaries seeking to leverage kernel-level vulnerabilities. The solution maintains system stability while ensuring proper resource management during cxl region operations and aligns with ATT&CK technique T1068 by preventing privilege escalation through kernel memory corruption.
The resolution effectively addresses the root cause by eliminating the direct dependency on potentially invalid indices while preserving the intended functionality of the cxl subsystem. This approach ensures that automatic attachment cancellation operations proceed safely regardless of intermediate calculation failures, maintaining system integrity and preventing unauthorized memory access patterns that could be exploited for malicious purposes.