CVE-2026-74273
- Source
- https://cve.org/CVERecord?id=CVE-2026-74273
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74273.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-74273
- Downstream
- Published
- 2026-08-15T05:57:46.134Z
- Modified
- 2026-08-18T03:31:21.879806103Z
- Summary
- cxl/region: Block region delete during region creation
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Block region delete during region creation
Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion() and attachtarget(), as well as the period between deviceadd() and registering the remove actions.
Otherwise, userspace can confuse the kernel. It can violate the assumption the region stays registered through the completion of cxladdtoregion(). It can violate the assumption that devmaddactionorreset() is working with a live 'struct cxlregion'.
It is ok for the region to disappear outside of those windows as that mirrors device hotplug flows where the proper locks are held.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74273.json" }- References
-
- https://git.kernel.org/stable/c/b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8
- https://git.kernel.org/stable/c/d91feb88692e81b00cd22f0125cfcd04970b4a0b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74273.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-74273
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git