Based on the description, it is inferred that a kernel bug in the CXL/region subsystem allows an out‑of‑bounds array access when a partition index is negative. The construct_region() function reads the partition value from the CXL device and uses it as an array index without verifying that it is non‑negative. If the partition was never resolved it remains at its initial value of –1, causing the kernel to access memory outside the valid bounds. This memory corruption can lead to a kernel crash or provide an attacker a foothold for arbitrary code execution. The issue is not a denial of service alone; the impact can be leveraged to compromise system integrity and confidentiality.

Any Linux kernel that contains the vulnerable implementation of cxl/region. The affected kernel versions are not specified in the data provided, but the patch that introduces a guard against negative partition indices is present in newer releases. The vulnerability applies to all vendors that ship this Linux kernel source and has been reported in the upstream kernel community.

Based on the description, it is inferred that if a malicious CXL device or driver can instruct the kernel to reference an uninitialized partition, the attacker could trigger out‑of‑bounds access and potentially execute arbitrary code in kernel mode. The exploit requires local or possibly remote code execution on the machine if an attacker can influence the CXL resource, and thus is considered a moderate‑risk vulnerability with a CVSS score of 5.5. The EPSS score is below 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog.