CVE-2026-74272

Received Received - Intake

Race Condition in Linux Kernel CXL Region Deletion

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Resolve region deletion races Sungwoo noticed that the sysfs trigger to delete a region may try to delete a region multiple times. It also has no exclusion relative to the kernel releasing the region via CXL root device teardown. Instead of installing new cxl root devres actions per region, use the existing root decoder unregistration event to remove all remaining regions. An xarray of regions replaces a devres list of regions. This handles 3 separate issues with the old approach: 1/ sysfs users racing to delete the same region: no longer possible now that the regions_lock is held over the lookup and deletion. 2/ multiple actions triggering deletion of the same region: solved by erasing regions while holding @regions_lock, and only proceeding on successful erasure. 3/ userspace racing devres_release_all() to trigger the devres not found warning: solved by sysfs unregistration not requiring a release action

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74272

EUVD

EUVD-2026-59419

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the CXL (Compute Express Link) region deletion process. The sysfs trigger for deleting a region could attempt to delete the same region multiple times or conflict with the kernel's automatic cleanup during CXL root device teardown. The fix replaces a devres list with an xarray of regions and uses the existing root decoder unregistration event to remove all remaining regions, preventing race conditions and ensuring proper cleanup.

Detection Guidance

This vulnerability is specific to the Linux kernel's CXL (Compute Express Link) subsystem and does not have network-based detection methods. Detection involves checking kernel logs for region deletion races or sysfs-related warnings related to CXL regions. Commands like dmesg | grep -i cxl or journalctl -k | grep -i cxl may help identify issues.

Impact Analysis

This vulnerability could lead to system instability or crashes if a region is improperly deleted multiple times or if cleanup conflicts occur. It may cause warnings or errors during normal operation, particularly in systems using CXL hardware. However, the impact is limited to CXL region management and does not directly affect general system security or data integrity.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel race condition in the CXL region deletion mechanism. No data exposure or privacy implications are described in the provided context.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-74272. The vulnerability is resolved by changes in the cxl/region subsystem, so applying the latest kernel updates is the primary mitigation step.

Hi! I’m here to help you understand CVE-2026-74272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70