CVE-2026-89570

What it actually does

The CXL MCE notifier was registered per memory device and stored in struct cxl_memdev_state, creating lifetime mismatches that allow NULL dereferences and use-after-free when the MCE handler runs after the backing structures have been freed.

Why it matters to the business

Local attackers can trigger kernel crashes or potential code execution on systems using CXL memory with extended linear cache, leading to denial of service or full host compromise; the issue affects Linux kernel deployments handling modern memory hardware.

How an attack unfolds

An attacker with local access triggers a machine-check error on a CXL region that has an extended linear cache; the stale per-device notifier fires after the region or endpoint has been torn down, dereferencing freed memory or a NULL pointer and allowing control-flow hijacking or panic.

How to fix it

Update to a Linux kernel containing the fix that moves the MCE notifier into struct cxl_region, registers it only from cxl_region_probe() for regions with extended linear cache, and removes the dead cxl_port_get_spa_cache_alias() function.

How to confirm the fix worked

Confirm the kernel source contains the per-region notifier registration in cxl_region_probe() and that cxl_port_get_spa_cache_alias() is absent; boot-test on CXL hardware with extended linear cache and verify no NULL dereference warnings occur during MCE injection.

Typical attack path

1. Obtain local user access on a Linux host with CXL memory regions enabled
2. Trigger or wait for an MCE event on a region that uses the extended linear cache
3. Cause the notifier callback to execute after the cxl_memdev_state or endpoint lifetime ends
4. Leverage the resulting use-after-free or NULL dereference for privilege escalation or denial of service

How to detect it

Review kernel logs for MCE notifier warnings referencing cxl_memdev_state or cxl_region lifetime errors; look for NULL pointer dereference or use-after-free stack traces in the CXL MCE path after region hot-remove or probe events.

What your security team should do

• Prioritize kernel updates on all systems exposing CXL memory regions
• Monitor vendor or distribution advisories for the exact backported commit
• Restrict local unprivileged access on high-value CXL hosts until patched
• Add CXL region MCE paths to crash-dump and kernel log review procedures