CVE-2026-92484: cxl/region: Fix use-after-free in find_pos_and_ways() error path
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Fix use-after-free in findposandways() error path
The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder can be freed before the error message accesses its name.
Drop the reference after the error is reported.
Event History
Frequently Asked Questions
When can this use-after-free occur?
It occurs on an error path in find_pos_and_ways() when a switch decoder reference is released before an error message accesses the decoder name. If that reference was the last one, the decoder may be freed before the name is logged.
What is the practical impact of the flaw?
The vulnerable code can access a freed switch decoder while reporting an error. The issue is specifically tied to error handling and logging after decoder reference release.
What change resolves the issue?
The fix reports the error while the switch decoder reference is still held, then drops the reference afterward.