CVE-2026-89570

Received Received - Intake

Memory Error Notifier Fix in Linux Kernel CXL

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size). Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage. Remove cxl_port_get_spa_cache_alias() as it is now dead code. [ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89570

EUVD

EUVD-2026-76481

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a NULL dereference and use-after-free issue in the CXL MCE notifier. The problem occurs because the notifier was incorrectly registered per memory device instead of per region, leading to lifetime management problems. The fix moves the notifier into the region structure to ensure proper handling of the region's state.

Detection Guidance

This vulnerability is specific to the Linux kernel's CXL (Compute Express Link) MCE notifier. Detection requires checking kernel logs for MCE (Machine Check Exception) errors related to CXL regions or memory devices. Use commands like 'dmesg | grep -i cxl' or 'journalctl -k | grep -i mce' to inspect for relevant errors.

Impact Analysis

This vulnerability could cause system crashes or instability due to NULL pointer dereferences or use-after-free errors in the MCE handler. If exploited, it might lead to denial-of-service conditions or potential privilege escalation in systems using the CXL (Compute Express Link) feature.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-89570. If updating is not immediately possible, consider disabling CXL-related features or restricting access to affected systems until patched.

Hi! I’m here to help you understand CVE-2026-89570. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70