CVE-2026-89570

cxl/mce: Make the MCE notifier per-region

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

cxl/mce: Make the MCE notifier per-region

Flavien Solt reported lifetime issues with the CXL MCE notifier, which
can lead to NULL dereferences and use-after-free in the MCE handler.
The notifier was registered per memory device and stored in 'struct
cxl_memdev_state', even though it only needs the region state (the
region's SPA range and its extended linear cache size).

Instead of keeping the memory device and endpoint alive, the correct fix
is to move the notifier into 'struct cxl_region' and register it from
cxl_region_probe() as it should be a per-region notifier. Setup the
registration to only happen for regions that have an extended linear
cache as that is the only current usage.

Remove cxl_port_get_spa_cache_alias() as it is now dead code.

[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]

Analysis

Technical impact

The vulnerability arises from a lifetime management flaw in the Linux kernel's CXL Memory Control Engine notifier. The notifier was freed prematurely. When the kernel later accessed the stale notifier reference during a machine‑exception event, it performed a NULL pointer dereference or a use-after‑free, causing a kernel crash. The weakness is a classic invalid memory reference (CWE-476).

Affected Systems

All Linux kernel releases that contain the pre‑fix notifier implementation are affected. The fix is included in commits referenced in the CVE description and is available in kernel versions that incorporate those changes. Systems running any older kernel that has not been updated to include those commits remain vulnerable.

Risk and Exploitability

The CVSS score of 7.8 classifies the flaw as high severity. The EPSS score of < 1 % indicates a very low exploitation probability. The CVE is not listed in the CISA KEV catalog. Because the flaw requires a CXL device to trigger the notifier and a machine‑exception event, the attack surface is narrow. The likely attack vector is an attacker with ability to cause or observe a machine‑exception on a system with CXL support. Given these constraints, widespread exploitation is unlikely, but the kernel crash results in denial of service, so timely patching is essential.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`516e5bd0b6bf4ae1ad072df637b428a737c3c870`	affected	< 5563db13c9528a56c7161260ec75ec8690dc5608
`516e5bd0b6bf4ae1ad072df637b428a737c3c870`	affected	< 491d8c9ac98d55073bda778f88a5248d4cce3fa0
`516e5bd0b6bf4ae1ad072df637b428a737c3c870`	affected	< 775d0f4558f4cec0ee0c8966595d1add1791f36e

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[516e5bd0b6bf4ae1ad072df637b428a737c3c870,5563db13c9528a56c7161260ec75ec8690dc5608)`	affected	code_commit	—
`[516e5bd0b6bf4ae1ad072df637b428a737c3c870,491d8c9ac98d55073bda778f88a5248d4cce3fa0)`	affected	code_commit	—
`[516e5bd0b6bf4ae1ad072df637b428a737c3c870,775d0f4558f4cec0ee0c8966595d1add1791f36e)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.15`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.18.51,6.19.0]`	unaffected	semver	—
`[7.2.4,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*)`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the commit adding per‑region notifier for CXL MCE, thereby eliminating the NULL dereference/use‑after‑free flaw (CWE-476).
If upgrading is not possible immediately, compile the kernel with the CXL MCE driver disabled (CONFIG_CXL_MCE=n) to prevent the vulnerable notifier from being registered.
Monitor kernel logs (dmesg/journal) for CXL MCE errors and consider postponing the use of CXL hardware until a patched kernel is available.

Generated by OpenCVE AI on September 15, 2026 at 21:49 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.168% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/491d8c9ac98d55073bda778f88a5248d4cce3fa0
https://git.kernel.org/stable/c/5563db13c9528a56c7161260ec75ec8690dc5608
https://git.kernel.org/stable/c/775d0f4558f4cec0ee0c8966595d1add1791f36e
https://nvd.nist.gov/vuln/detail/CVE-2026-89570
https://www.cve.org/CVERecord?id=CVE-2026-89570

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 5:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sep 12, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89570 https://www.cve.org/CVERecord?id=CVE-2026-89570
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 12, 2026 10:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-476

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size). Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage. Remove cxl_port_get_spa_cache_alias() as it is now dead code. [ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]
Title		cxl/mce: Make the MCE notifier per-region
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/491d8c9ac98d55073bda778f88a5248d4cce3fa0 https://git.kernel.org/stable/c/5563db13c9528a56c7161260ec75ec8690dc5608 https://git.kernel.org/stable/c/775d0f4558f4cec0ee0c8966595d1add1791f36e