CVE-2026-74273

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74273", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.879Z", "datePublished": "2026-08-15T05:57:46.134Z", "dateUpdated": "2026-10-21T12:45:15.193Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:45:15.193Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Block region delete during region creation\n\nExpand the range lock, rename it \"regions_lock\", to disable region deletion\nin the critical period between construct_region() and attach_target(), as\nwell as the period between device_add() and registering the remove actions.\n\nOtherwise, userspace can confuse the kernel. It can violate the assumption\nthe region stays registered through the completion of cxl_add_to_region().\nIt can violate the assumption that devm_add_action_or_reset() is working\nwith a live 'struct cxl_region'.\n\nIt is ok for the region to disappear outside of those windows as that\nmirrors device hotplug flows where the proper locks are held."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/cxl/core/port.c", "drivers/cxl/core/region.c", "drivers/cxl/cxl.h"], "versions": [{"version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "lessThan": "8efa9fcc1d31b29b31e0ac4efe48624a729796bc", "status": "affected", "versionType": "git"}, {"version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "lessThan": "ecc86a28dc27509da511bb3f8c309750233e3177", "status": "affected", "versionType": "git"}, {"version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "lessThan": "98c7e206af48b4433b2192cc1a538db2acc49876", "status": "affected", "versionType": "git"}, {"version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "lessThan": "b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8", "status": "affected", "versionType": "git"}, {"version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "lessThan": "d91feb88692e81b00cd22f0125cfcd04970b4a0b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/cxl/core/port.c", "drivers/cxl/core/region.c", "drivers/cxl/cxl.h"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8efa9fcc1d31b29b31e0ac4efe48624a729796bc"}, {"url": "https://git.kernel.org/stable/c/ecc86a28dc27509da511bb3f8c309750233e3177"}, {"url": "https://git.kernel.org/stable/c/98c7e206af48b4433b2192cc1a538db2acc49876"}, {"url": "https://git.kernel.org/stable/c/b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8"}, {"url": "https://git.kernel.org/stable/c/d91feb88692e81b00cd22f0125cfcd04970b4a0b"}], "title": "cxl/region: Block region delete during region creation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/cxl/core/port.c", "drivers/cxl/core/region.c", "drivers/cxl/cxl.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8efa9fcc1d31b29b31e0ac4efe48624a729796bc", "status": "affected", "version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "versionType": "git"}, {"lessThan": "ecc86a28dc27509da511bb3f8c309750233e3177", "status": "affected", "version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "versionType": "git"}, {"lessThan": "98c7e206af48b4433b2192cc1a538db2acc49876", "status": "affected", "version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "versionType": "git"}, {"lessThan": "b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8", "status": "affected", "version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "versionType": "git"}, {"lessThan": "d91feb88692e81b00cd22f0125cfcd04970b4a0b", "status": "affected", "version": "a32320b71f085f8d82afedcf285f1682c8c00aed", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/cxl/core/port.c", "drivers/cxl/core/region.c", "drivers/cxl/cxl.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Block region delete during region creation\n\nExpand the range lock, rename it \"regions_lock\", to disable region deletion\nin the critical period between construct_region() and attach_target(), as\nwell as the period between device_add() and registering the remove actions.\n\nOtherwise, userspace can confuse the kernel. It can violate the assumption\nthe region stays registered through the completion of cxl_add_to_region().\nIt can violate the assumption that devm_add_action_or_reset() is working\nwith a live 'struct cxl_region'.\n\nIt is ok for the region to disappear outside of those windows as that\nmirrors device hotplug flows where the proper locks are held."}], "id": "CVE-2026-74273", "lastModified": "2026-10-21T13:19:40.990", "metrics": {}, "published": "2026-08-15T06:22:26.697", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8efa9fcc1d31b29b31e0ac4efe48624a729796bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/98c7e206af48b4433b2192cc1a538db2acc49876"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d91feb88692e81b00cd22f0125cfcd04970b4a0b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ecc86a28dc27509da511bb3f8c309750233e3177"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: cxl/region: Block region delete during region creation", "id": "2516913", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516913"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncxl/region: Block region delete during region creation\nExpand the range lock, rename it \"regions_lock\", to disable region deletion\nin the critical period between construct_region() and attach_target(), as\nwell as the period between device_add() and registering the remove actions.\nOtherwise, userspace can confuse the kernel. It can violate the assumption\nthe region stays registered through the completion of cxl_add_to_region().\nIt can violate the assumption that devm_add_action_or_reset() is working\nwith a live 'struct cxl_region'.\nIt is ok for the region to disappear outside of those windows as that\nmirrors device hotplug flows where the proper locks are held.", "A flaw was found in the Linux kernel's cxl/region component. A local user could exploit a race condition during the creation and deletion of regions. This could lead to the kernel becoming confused about the state of a region, potentially causing system instability or a denial of service (DoS)."], "name": "CVE-2026-74273", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74273\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74273\nhttps://lore.kernel.org/linux-cve-announce/2026081544-CVE-2026-74273-f9f6@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a32320b71f085f8d82afedcf285f1682c8c00aed,b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a32320b71f085f8d82afedcf285f1682c8c00aed,d91feb88692e81b00cd22f0125cfcd04970b4a0b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:00:11.224513+00:00", "updated": "2026-08-22T04:00:12.151251+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}