CVE-2026-97423
Linux: cxl/region: Validate partition index before array access
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in06322da06116f1ee52271dd4d84dc69580087df7Also 16329b510f76e5b824e05bf8add8b29850f1f16fCVE List
What fixes it
- 06322da06116f1ee52271dd4d84dc69580087df7LinuxCVE List
- 16329b510f76e5b824e05bf8add8b29850f1f16fLinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Validate partition index before array access
construct_region() reads cxled->part and uses it to index cxlds->part[] without checking for a negative value. If the partition was never resolved, part remains at its initial value of -1, causing an out-of-bounds array access.
Add a guard to return -EBUSY when part is negative.
The check was dropped during a merge.
Text from CVE List
Affected versions 6
- Linuxaffected: b6faa9c613787b894913638a76030018f6d62d54 before 06322da06116f1ee52271dd4d84dc69580087df7CVE List
- Linuxaffected: b6faa9c613787b894913638a76030018f6d62d54 before 16329b510f76e5b824e05bf8add8b29850f1f16fCVE List
- Linuxaffected: 6.15CVE List
- Linuxunaffected: all versions before 6.15CVE List
- Linuxunaffected: 6.18.53 through 6.18.*CVE List
- Linuxunaffected: 7.2CVE List