Linux kernel CXL: MCE notifier outlives its memory device, giving NULL deref and use-after-free

Impact

The CXL machine-check notifier was registered per memory device and stored in struct cxl_memdev_state even though it only needs region state, so its lifetime did not match the objects it dereferences. The reported result is NULL pointer dereferences and use-after-free inside the MCE handler - code that runs when the platform reports a memory error, precisely the moment an operator least wants the host to fall over in an unpredictable way. On hosts using CXL memory expansion behind GPU nodes, a correctable-error storm from a flaky device can now take the host down or corrupt memory rather than being logged and handled.

Who can reach it

Not a remote or tenant-driven path. Triggered by machine-check events on a host with CXL devices, in combination with device teardown or hotplug that frees the endpoint state the notifier still references. Physical or administrative control of CXL device presence is what drives it.

What to do

Take the stable kernel update that moves the notifier into struct cxl_region and registers it from cxl_region_probe() only for regions with an extended linear cache. Rolling it out means draining and rebooting the affected hosts. Hosts with no CXL memory devices are not exposed and can be deferred. The record gives three stable commits and no fixed release numbers.

References

Related entries

• Linux kernel CXL fwctl: unchecked op_size reads past the input buffer and into the device mailboxCVE-2026-89571 · Linux kernel CXL features fwctl (cxlctl_fw_rpc op_size validation)Unscored
• Linux kernel BPF: preemptible bpf_get_stack reuses a per-CPU callchain buffer and writes out of boundsCVE-2026-89580 · Linux kernel BPF __bpf_get_stack (per-CPU callchain entry reuse)Unscored
• Linux kernel BPF x86 JIT: per-CPU address lands in the wrong register, clobbering RAX or the frame pointerCVE-2026-89581 · Linux kernel BPF x86-64 JIT (per-CPU address MOV register encoding)Unscored
• Linux kernel GHES: CXL CPER work locks taken without IRQ protection can deadlock a CPUCVE-2026-89589 · Linux kernel ACPI APEI GHES (CXL CPER work locks)Unscored
• Linux kernel hugetlb: reservation counter underflow when a parent unmaps a shared huge page firstCVE-2026-89593 · Linux kernel hugetlb (__unmap_hugepage_range reservation accounting)Unscored
• Linux kernel efivarfs: unprivileged statfs() floods the UEFI QueryVariableInfo runtime serviceCVE-2026-89604 · Linux kernel efivarfs (statfs handler, QueryVariableInfo rate limit)Unscored