CVE-2026-97423: cxl/region: Validate partition index before array access
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Validate partition index before array access
constructregion() reads cxled->part and uses it to index cxlds->part[] without checking for a negative value. If the partition was never resolved, part remains at its initial value of -1, causing an out-of-bounds array access.
Add a guard to return -EBUSY when part is negative.
The check was dropped during a merge.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a guard in construct_region() to validate cxled->part before indexing cxlds->part[], returning -EBUSY if the partition index is negative.
Linux kernel CXL region construct_region() partition index validation = return -EBUSY when cxled->part is negative
Event History
Frequently Asked Questions
Under what condition can the out-of-bounds access occur?
It can occur when construct_region() handles a CXL device whose partition has not been resolved. In that state, cxled->part remains -1 and is used as an index into cxlds->part[].
What behavior does the fix introduce for an unresolved partition?
The fix validates the partition index before array access. When the partition index is negative, construct_region() returns -EBUSY instead of indexing the partition array.