CVE-2026-97423

Received Received - Intake

Out-of-Bounds Access in Linux Kernel CXL Region

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Validate partition index before array access construct_region() reads cxled->part and uses it to index cxlds->part[] without checking for a negative value. If the partition was never resolved, part remains at its initial value of -1, causing an out-of-bounds array access. Add a guard to return -EBUSY when part is negative. The check was dropped during a merge.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97423

EUVD

EUVD-2026-86036

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's cxl/region component. It involves a missing check for a negative partition index value. When a partition is not resolved, the index remains at -1, leading to an out-of-bounds array access in cxlds->part[]. This can cause memory corruption or crashes.

Detection Guidance

This vulnerability involves an out-of-bounds array access in the Linux kernel's cxl/region module due to an unchecked negative partition index. Detection requires checking kernel logs for related errors or crashes involving the cxl subsystem. Monitor for kernel oops messages or segmentation faults in processes interacting with CXL devices.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or trigger undefined behavior like memory corruption. It may also lead to privilege escalation if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. It is a low-level kernel memory access issue that could lead to system instability or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-97423. The vulnerability involves an out-of-bounds array access in the cxl/region component due to unvalidated partition index.

Hi! I’m here to help you understand CVE-2026-97423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70