CVE-2026-92484

What it actually does

Use-after-free in Linux kernel CXL region code where a switch decoder reference is dropped in the find_pos_and_ways() error path before an error log that dereferences the decoder name, allowing the object to be freed if the reference was final.

Why it matters to the business

Potential kernel instability, crashes, or memory corruption on systems using CXL hardware, which can interrupt operations on servers relying on high-performance memory interconnects and increase unplanned downtime risk.

How an attack unfolds

An attacker with local access triggers the specific error condition in find_pos_and_ways() on a CXL-enabled system; the premature reference drop allows the decoder to be freed, after which the subsequent name access in the error log causes the use-after-free.

How to fix it

Apply the upstream fix that moves the decoder reference release after the error logging statement; rebuild and deploy updated kernels containing the corrected cxl/region logic.

How to confirm the fix worked

Inspect the source of find_pos_and_ways() to confirm the reference drop occurs after error logging; verify the running kernel version or commit history includes the corrected ordering.

Typical attack path

1. Obtain local code execution on a CXL-enabled Linux system
2. Craft or induce the error condition that enters the vulnerable error path in find_pos_and_ways()
3. Trigger the reference release before the error log statement executes
4. Cause the final reference to be dropped so the decoder object is freed
5. Execute the log statement that accesses the now-freed decoder name

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing find_pos_and_ways() or CXL decoder objects around the time of unexpected reboots on CXL systems.

What your security team should do

• Prioritize kernel updates for all CXL-enabled hosts within standard patch windows
• Review CXL hardware deployments for exposure and schedule targeted testing
• Monitor kernel update channels for the published fix and backports