Linux Kernel up to 7.1.4 cxl/region construct_region locking

Summaryinfo

A vulnerability described as very critical has been identified in Linux Kernel up to 7.1.4. This impacts the function construct_region of the component cxl/region. The manipulation results in locking. This vulnerability is cataloged as CVE-2026-74273. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.1.4. Affected is the function construct_region of the component cxl/region. The manipulation with an unknown input leads to a locking vulnerability. CWE is classifying the issue as CWE-667. The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regions_lock", to disable region deletion in the critical period between construct_region() and attach_target(), as well as the period between device_add() and registering the remove actions. Otherwise, userspace can confuse the kernel. It can violate the assumption the region stays registered through the completion of cxl_add_to_region(). It can violate the assumption that devm_add_action_or_reset() is working with a live 'struct cxl_region'. It is ok for the region to disappear outside of those windows as that mirrors device hotplug flows where the proper locks are held.

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2026-74273 since 08/15/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/15/2026).

Upgrading to version 7.1.5 or 7.2-rc1 eliminates this vulnerability. Applying the patch b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8/d91feb88692e81b00cd22f0125cfcd04970b4a0b is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion