CVE-2026-97423cxl/region: Validate partition index before array access
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Validate partition index before array access construct_region() reads cxled->part and uses it to index cxlds->part[] without checking for a negative value. If the partition was never resolved, part remains at its initial value of -1, causing an out-of-bounds array access. Add a guard to return -EBUSY when part is negative. The check was dropped during a merge.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b6faa9c613787b894913638a76030018f6d62d54 before 06322da06116f1ee52271dd4d84dc69580087df7; from b6faa9c613787b894913638a76030018f6d62d54 before 16329b510f76e5b824e05bf8add8b29850f1f16f | CNA record |
References
- https://git.kernel.org/stable/c/06322da06116f1ee52271dd4d84dc69580087df7
- https://git.kernel.org/stable/c/16329b510f76e5b824e05bf8add8b29850f1f16f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.