A race condition in the Linux kernel’s CXL region management code allows the sysfs trigger used to delete a region to attempt deletion multiple times and to operate concurrently with the kernel’s teardown of a CXL root device. The flaw is addressed by holding the region lock during lookup and deletion, eliminating redundancy and preventing deletion during teardown.

All Linux kernel builds that have not received the upstream change are affected. This includes any distribution shipping a kernel version prior to the application of the fix, regardless of custom kernel configuration. The vendor identifiers listed are generic Linux kernels.

The CVSS base score is 5.5 and the EPSS score is less than 1%, indicating a low probability of exploitation. The issue is not listed in the CISA KEV catalog. Attackers would need local write access to the sysfs deletion interface and must induce a race between deletion attempts or between deletion and device teardown. The vulnerability is characterized by CWE-367.