What’s Vulnerable › Vulnerabilities

CVE-2026-97423: cxl/region: Validate partition index before array access

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-24 · updated 2026-09-25

Description

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Validate partition index before array access construct_region() reads cxled->part and uses it to index cxlds->part[] without checking for a negative value. If the partition was never resolved, part remains at its initial value of -1, causing an out-of-bounds array access. Add a guard to return -EBUSY when part is negative. The check was dropped during a merge.

Affected products

• Linux kernel: 6.15 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/06322da06116f1ee52271dd4d84dc69580087df7
• https://git.kernel.org/stable/c/16329b510f76e5b824e05bf8add8b29850f1f16f

Get alerted when CVE-2026-97423 or the next vulnerability affects your stack