The Linux kernel’s Compute Express Link (CXL) driver contains a race condition that allows a userspace process to delete a region while it is being created or attached. During the critical windows between construct_region() and attach_target(), or between device_add() and the registration of remove actions, the absence of a protecting lock lets the deletion proceed, breaking the assumption that the region remains registered. This violation can lead to memory corruption, a kernel crash, or a denial of service.

All Linux kernel releases that expose CXL region operations and that have not incorporated the regions_lock patch are affected. The vulnerability applies regardless of vendor because the issue is within the core kernel driver.

The vulnerability is listed with an EPSS score of <1%, indicating a low but nonzero projected exploitation probability, and it is not in the CISA KEV catalog. The CVSS score of 5.5 indicates a moderate severity. The description infers that the attack vector is a race condition triggered by an authorized userspace actor that can perform CXL region operations. No privilege escalation is required beyond the ability to delete a CXL region, and the exploit would most likely manifest as kernel instability or service interruption.