Memory Leak in Linux Kernel cxl/region Component Fixed

Publication date: 2026-04-22

Last updated on: 2026-04-28

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix leakage in __construct_region() Failing the first sysfs_update_group() needs to explicitly kfree the resource as it is too early for cxl_region_iomem_release() to do so.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-22

Last Modified

2026-04-28

Generated

2026-07-06

AI Q&A

2026-04-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-31529

EUVD

EUVD-2026-24923

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.19 (inc) to 6.19.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel, specifically in the cxl/region component. It involves a leakage issue in the __construct_region() function. When the first sysfs_update_group() call fails, the resource is not properly freed early enough, because it is too soon for the cxl_region_iomem_release() function to handle the cleanup. This can lead to resource leakage.

Impact Analysis

The impact of this vulnerability is resource leakage within the Linux kernel's cxl/region subsystem. This could potentially lead to increased memory usage or resource exhaustion, which might degrade system performance or stability.

Hi! I’m here to help you understand CVE-2026-31529. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70