CVE-2026-74273

A flaw was found in the Linux kernel's cxl/region component. A local user could exploit a race condition during the creation and deletion of regions. This could lead to the kernel becoming confused about the state of a region, potentially causing system instability or a denial of service (DoS).

This vulnerability is rated as Moderate severity because it is constrained to a local denial of service on systems utilizing Compute Express Link (CXL) infrastructure. To trigger this race condition, a local actor must have sufficient privileges to manipulate CXL device endpoints and concurrently execute memory region creation and deletion routines. Exploitation results in kernel instability without compromising data confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.