CVE-2026-74273: cxl/region: Block region delete during region creation
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Block region delete during region creation
Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion() and attachtarget(), as well as the period between deviceadd() and registering the remove actions.
Otherwise, userspace can confuse the kernel. It can violate the assumption the region stays registered through the completion of cxladdtoregion(). It can violate the assumption that devmaddactionorreset() is working with a live 'struct cxlregion'.
It is ok for the region to disappear outside of those windows as that mirrors device hotplug flows where the proper locks are held.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In cxl/region, block region delete during the critical period between construct_region() and attach_target() (and during the period between device_add() and registering the remove actions) by expanding/renaming the range lock to "regions_lock" so region deletion is disabled while the live struct cxl_region is being created.
Linux kernel (cxl/region) Expand the range lock, rename it "regions_lock", to disable region deletion = disabled