cxl/region: Block region delete during region creation

Summary

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regions_lock", to disable region deletion in the critical period between construct_region() and attach_target(), as well as the period between device_add() and registering the remove actions. Otherwise, userspace can confuse the kernel. It can violate the assumption the region stays registered through the completion of cxl_add_to_region(). It can violate the assumption that devm_add_action_or_reset() is working with a live 'struct cxl_region'. It is ok for the region to disappear outside of those windows as that mirrors device hotplug flows where the proper locks are held.

Timeline

1. Aug 15, 2026, 5:57 AM UTCCVE published
2. Oct 21, 2026, 12:45 PM UTCRecord last updated

Affected versions

• Linux Linux

  From a32320b71f085f8d82afedcf285f1682c8c00aed · fixed in 8efa9fcc1d31b29b31e0ac4efe48624a729796bc; From a32320b71f085f8d82afedcf285f1682c8c00aed · fixed in ecc86a28dc27509da511bb3f8c309750233e3177; From a32320b71f085f8d82afedcf285f1682c8c00aed · fixed in 98c7e206af48b4433b2192cc1a538db2acc49876; From a32320b71f085f8d82afedcf285f1682c8c00aed · fixed in b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8; From a32320b71f085f8d82afedcf285f1682c8c00aed · fixed in d91feb88692e81b00cd22f0125cfcd04970b4a0b

• Linux Linux

  6.3

• KernelLinux

  From 6.3.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.1.5

References 5