GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89570 (GCVE-0-2026-89570)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:31
VLAI
Title
cxl/mce: Make the MCE notifier per-region
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size). Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage. Remove cxl_port_get_spa_cache_alias() as it is now dead code. [ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 516e5bd0b6bf4ae1ad072df637b428a737c3c870 , < 5563db13c9528a56c7161260ec75ec8690dc5608 (git)
Affected: 516e5bd0b6bf4ae1ad072df637b428a737c3c870 , < 491d8c9ac98d55073bda778f88a5248d4cce3fa0 (git)
Affected: 516e5bd0b6bf4ae1ad072df637b428a737c3c870 , < 775d0f4558f4cec0ee0c8966595d1add1791f36e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/mbox.c",
            "drivers/cxl/core/mce.c",
            "drivers/cxl/core/region.c",
            "drivers/cxl/cxl.h",
            "drivers/cxl/cxlmem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5563db13c9528a56c7161260ec75ec8690dc5608",
              "status": "affected",
              "version": "516e5bd0b6bf4ae1ad072df637b428a737c3c870",
              "versionType": "git"
            },
            {
              "lessThan": "491d8c9ac98d55073bda778f88a5248d4cce3fa0",
              "status": "affected",
              "version": "516e5bd0b6bf4ae1ad072df637b428a737c3c870",
              "versionType": "git"
            },
            {
              "lessThan": "775d0f4558f4cec0ee0c8966595d1add1791f36e",
              "status": "affected",
              "version": "516e5bd0b6bf4ae1ad072df637b428a737c3c870",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/mbox.c",
            "drivers/cxl/core/mce.c",
            "drivers/cxl/core/region.c",
            "drivers/cxl/cxl.h",
            "drivers/cxl/cxlmem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mce: Make the MCE notifier per-region\n\nFlavien Solt reported lifetime issues with the CXL MCE notifier, which\ncan lead to NULL dereferences and use-after-free in the MCE handler.\nThe notifier was registered per memory device and stored in \u0027struct\ncxl_memdev_state\u0027, even though it only needs the region state (the\nregion\u0027s SPA range and its extended linear cache size).\n\nInstead of keeping the memory device and endpoint alive, the correct fix\nis to move the notifier into \u0027struct cxl_region\u0027 and register it from\ncxl_region_probe() as it should be a per-region notifier. Setup the\nregistration to only happen for regions that have an extended linear\ncache as that is the only current usage.\n\nRemove cxl_port_get_spa_cache_alias() as it is now dead code.\n\n[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - cxl_handle_mce() is invoked from the host x86 MCE decode chain (mce_gen_pool_process() workqueue) after a local machine check; it is not reached from a network protocol, Bluetooth/WiFi, or USB handler. Local access to a CXL Type-3 host is the applicable vector (higher severity than Physical).\nAC:L - The notifier is registered on the PCI device before cxlds-\u003ecxlmd is set and while cxlmd-\u003eendpoint is ERR_PTR(-ENXIO); cxl_memdev_unregister() never NULLs cxlmd, so probe/AER/unbind leaves a dangling pointer while the notifier stays registered. Any later MCE with a usable address hits the UAF/NULL deref deterministically; EINJ/mce-inject also make the trigger attacker-controlled.\nPR:L - cxl_handle_mce() has no capability check; cxl_pci probe installs the notifier automatically. CXL Type-3 capacity is ordinary System RAM any unprivileged local user can allocate, and async probe, cxl_mem not-yet-bound (ERR_PTR endpoint), or AER-driven detach create the bad lifetime state without init-namespace root, matching CVE-2024-26762.\nUI:N - MCE decode and CXL probe/unbind/AER recovery run in kernel workqueues with no victim mount, file open, or other interactive action; the attacker (or automatic error handling) drives the path themselves.\nS:U - The NULL dereference and use-after-free corrupt host kernel CXL/MCE state in the same OS security authority. This is standard kernel memory corruption/privilege escalation, not a KVM/IOMMU/sandbox boundary crossing.\nC:H - The handler dereferences mds-\u003ecxlds.cxlmd and cxlmd-\u003eendpoint (and walks endpoint-\u003eregions) after those objects can be freed, a use-after-free that can be reclaimed to expose kernel memory. CVSS kernel guidance treats UAF as High confidentiality impact.\nI:H - The same UAF is groomable for an arbitrary write. The callback also computes spa_alias from the dangling objects and calls memory_failure()/set_mce_nospec() on that PFN, so a sprayed cxl_memdev/region can offline attacker-chosen pages and hijack control flow.\nA:H - NULL deref of cxlmd, walking an ERR_PTR endpoint, and UAF of freed memdev/port/region objects cause a kernel oops/panic in the MCE workqueue; UAFs also crash even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:07.784Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5563db13c9528a56c7161260ec75ec8690dc5608"
        },
        {
          "url": "https://git.kernel.org/stable/c/491d8c9ac98d55073bda778f88a5248d4cce3fa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/775d0f4558f4cec0ee0c8966595d1add1791f36e"
        }
      ],
      "title": "cxl/mce: Make the MCE notifier per-region",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89570",
    "datePublished": "2026-09-11T19:44:39.584Z",
    "dateReserved": "2026-09-11T19:38:34.726Z",
    "dateUpdated": "2026-09-13T06:31:07.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89570",
      "date": "2026-09-17",
      "epss": "0.00124",
      "percentile": "0.02429"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89570\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:41.050\",\"lastModified\":\"2026-09-13T07:17:22.967\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/mce: Make the MCE notifier per-region\\n\\nFlavien Solt reported lifetime issues with the CXL MCE notifier, which\\ncan lead to NULL dereferences and use-after-free in the MCE handler.\\nThe notifier was registered per memory device and stored in \u0027struct\\ncxl_memdev_state\u0027, even though it only needs the region state (the\\nregion\u0027s SPA range and its extended linear cache size).\\n\\nInstead of keeping the memory device and endpoint alive, the correct fix\\nis to move the notifier into \u0027struct cxl_region\u0027 and register it from\\ncxl_region_probe() as it should be a per-region notifier. Setup the\\nregistration to only happen for regions that have an extended linear\\ncache as that is the only current usage.\\n\\nRemove cxl_port_get_spa_cache_alias() as it is now dead code.\\n\\n[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/cxl/core/mbox.c\",\"drivers/cxl/core/mce.c\",\"drivers/cxl/core/region.c\",\"drivers/cxl/cxl.h\",\"drivers/cxl/cxlmem.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"516e5bd0b6bf4ae1ad072df637b428a737c3c870\",\"lessThan\":\"5563db13c9528a56c7161260ec75ec8690dc5608\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"516e5bd0b6bf4ae1ad072df637b428a737c3c870\",\"lessThan\":\"491d8c9ac98d55073bda778f88a5248d4cce3fa0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"516e5bd0b6bf4ae1ad072df637b428a737c3c870\",\"lessThan\":\"775d0f4558f4cec0ee0c8966595d1add1791f36e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/cxl/core/mbox.c\",\"drivers/cxl/core/mce.c\",\"drivers/cxl/core/region.c\",\"drivers/cxl/cxl.h\",\"drivers/cxl/cxlmem.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/491d8c9ac98d55073bda778f88a5248d4cce3fa0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5563db13c9528a56c7161260ec75ec8690dc5608\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/775d0f4558f4cec0ee0c8966595d1add1791f36e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T06:52:21+00:00",
      "cve": "CVE-2026-89570",
      "id": "CVE-2026-89570",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cxl/mce: Make the MCE notifier per-region",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89570.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:01Z",
      "cve": "CVE-2026-89570",
      "id": "CVE-2026-89570",
      "initial_release_date": "2026-09-16T00:02:01Z",
      "product_status:known_affected": "12",
      "product_status:known_not_affected": "341",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89570",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89570.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.