Vulnerability-Lookup

GHSA-5C9G-7VF9-4PWC

Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-13 09:32

Details

In the Linux kernel, the following vulnerability has been resolved:

cxl/mce: Make the MCE notifier per-region

Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size).

Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage.

Remove cxl_port_get_spa_cache_alias() as it is now dead code.

[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89570"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T20:19:41Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mce: Make the MCE notifier per-region\n\nFlavien Solt reported lifetime issues with the CXL MCE notifier, which\ncan lead to NULL dereferences and use-after-free in the MCE handler.\nThe notifier was registered per memory device and stored in \u0027struct\ncxl_memdev_state\u0027, even though it only needs the region state (the\nregion\u0027s SPA range and its extended linear cache size).\n\nInstead of keeping the memory device and endpoint alive, the correct fix\nis to move the notifier into \u0027struct cxl_region\u0027 and register it from\ncxl_region_probe() as it should be a per-region notifier. Setup the\nregistration to only happen for regions that have an extended linear\ncache as that is the only current usage.\n\nRemove cxl_port_get_spa_cache_alias() as it is now dead code.\n\n[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]",
  "id": "GHSA-5c9g-7vf9-4pwc",
  "modified": "2026-09-13T09:32:19Z",
  "published": "2026-09-11T21:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89570"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/491d8c9ac98d55073bda778f88a5248d4cce3fa0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5563db13c9528a56c7161260ec75ec8690dc5608"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/775d0f4558f4cec0ee0c8966595d1add1791f36e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-89570 (GCVE-0-2026-89570)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:31

Title

cxl/mce: Make the MCE notifier per-region

Summary

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size). Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage. Remove cxl_port_get_spa_cache_alias() as it is now dead code. [ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/5563db13c9528a56c…
https://git.kernel.org/stable/c/491d8c9ac98d55073…
https://git.kernel.org/stable/c/775d0f4558f4cec0e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 516e5bd0b6bf4ae1ad072df637b428a737c3c870 , < 5563db13c9528a56c7161260ec75ec8690dc5608 (git) Affected: 516e5bd0b6bf4ae1ad072df637b428a737c3c870 , < 491d8c9ac98d55073bda778f88a5248d4cce3fa0 (git) Affected: 516e5bd0b6bf4ae1ad072df637b428a737c3c870 , < 775d0f4558f4cec0ee0c8966595d1add1791f36e (git)
Linux	Linux	Affected: 6.15 Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/mbox.c",
            "drivers/cxl/core/mce.c",
            "drivers/cxl/core/region.c",
            "drivers/cxl/cxl.h",
            "drivers/cxl/cxlmem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5563db13c9528a56c7161260ec75ec8690dc5608",
              "status": "affected",
              "version": "516e5bd0b6bf4ae1ad072df637b428a737c3c870",
              "versionType": "git"
            },
            {
              "lessThan": "491d8c9ac98d55073bda778f88a5248d4cce3fa0",
              "status": "affected",
              "version": "516e5bd0b6bf4ae1ad072df637b428a737c3c870",
              "versionType": "git"
            },
            {
              "lessThan": "775d0f4558f4cec0ee0c8966595d1add1791f36e",
              "status": "affected",
              "version": "516e5bd0b6bf4ae1ad072df637b428a737c3c870",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/mbox.c",
            "drivers/cxl/core/mce.c",
            "drivers/cxl/core/region.c",
            "drivers/cxl/cxl.h",
            "drivers/cxl/cxlmem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mce: Make the MCE notifier per-region\n\nFlavien Solt reported lifetime issues with the CXL MCE notifier, which\ncan lead to NULL dereferences and use-after-free in the MCE handler.\nThe notifier was registered per memory device and stored in \u0027struct\ncxl_memdev_state\u0027, even though it only needs the region state (the\nregion\u0027s SPA range and its extended linear cache size).\n\nInstead of keeping the memory device and endpoint alive, the correct fix\nis to move the notifier into \u0027struct cxl_region\u0027 and register it from\ncxl_region_probe() as it should be a per-region notifier. Setup the\nregistration to only happen for regions that have an extended linear\ncache as that is the only current usage.\n\nRemove cxl_port_get_spa_cache_alias() as it is now dead code.\n\n[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - cxl_handle_mce() is invoked from the host x86 MCE decode chain (mce_gen_pool_process() workqueue) after a local machine check; it is not reached from a network protocol, Bluetooth/WiFi, or USB handler. Local access to a CXL Type-3 host is the applicable vector (higher severity than Physical).\nAC:L - The notifier is registered on the PCI device before cxlds-\u003ecxlmd is set and while cxlmd-\u003eendpoint is ERR_PTR(-ENXIO); cxl_memdev_unregister() never NULLs cxlmd, so probe/AER/unbind leaves a dangling pointer while the notifier stays registered. Any later MCE with a usable address hits the UAF/NULL deref deterministically; EINJ/mce-inject also make the trigger attacker-controlled.\nPR:L - cxl_handle_mce() has no capability check; cxl_pci probe installs the notifier automatically. CXL Type-3 capacity is ordinary System RAM any unprivileged local user can allocate, and async probe, cxl_mem not-yet-bound (ERR_PTR endpoint), or AER-driven detach create the bad lifetime state without init-namespace root, matching CVE-2024-26762.\nUI:N - MCE decode and CXL probe/unbind/AER recovery run in kernel workqueues with no victim mount, file open, or other interactive action; the attacker (or automatic error handling) drives the path themselves.\nS:U - The NULL dereference and use-after-free corrupt host kernel CXL/MCE state in the same OS security authority. This is standard kernel memory corruption/privilege escalation, not a KVM/IOMMU/sandbox boundary crossing.\nC:H - The handler dereferences mds-\u003ecxlds.cxlmd and cxlmd-\u003eendpoint (and walks endpoint-\u003eregions) after those objects can be freed, a use-after-free that can be reclaimed to expose kernel memory. CVSS kernel guidance treats UAF as High confidentiality impact.\nI:H - The same UAF is groomable for an arbitrary write. The callback also computes spa_alias from the dangling objects and calls memory_failure()/set_mce_nospec() on that PFN, so a sprayed cxl_memdev/region can offline attacker-chosen pages and hijack control flow.\nA:H - NULL deref of cxlmd, walking an ERR_PTR endpoint, and UAF of freed memdev/port/region objects cause a kernel oops/panic in the MCE workqueue; UAFs also crash even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:07.784Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5563db13c9528a56c7161260ec75ec8690dc5608"
        },
        {
          "url": "https://git.kernel.org/stable/c/491d8c9ac98d55073bda778f88a5248d4cce3fa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/775d0f4558f4cec0ee0c8966595d1add1791f36e"
        }
      ],
      "title": "cxl/mce: Make the MCE notifier per-region",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89570",
    "datePublished": "2026-09-11T19:44:39.584Z",
    "dateReserved": "2026-09-11T19:38:34.726Z",
    "dateUpdated": "2026-09-13T06:31:07.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.