A lifetime‑management flaw in the CXL Memory Control Engine (MCE) notifier caused object references to persist beyond their intended scope. When the notifier, registered per memory device, was accessed after the device had been freed, the kernel performed a NULL pointer dereference or a use‑after‑free within the MCE handler. This fault can trigger a crash or corruption that results in denial of service. The core weakness is a classic memory‑corruption flaw, which aligns with common exploitation patterns.

The vulnerability affects the Linux kernel. Any kernel release that includes the old cxl/mce notifier implementation is susceptible; the fix is applied in the upstream kernel commits referenced in the CVE description. Based on the description, it is inferred that all kernel versions before the commit that introduces the per‑region notifier are affected and should be considered impacted.

With a CVSS score of 4.1, the vulnerability is considered low to moderate severity. The EPSS score of < 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires a system with CXL enabled and an attacker capable of inducing or observing machine‑exception events to trigger execution. Because exploitation needs a CXL device and a hardware machine‑exception, the attack surface is narrow, reducing the likelihood of widespread abuse. However, the impact of a kernel crash can lead to denial of service, so the availability of a patch is critical.