CVE-2026-74275

A flaw was found in the Linux kernel. A vulnerability exists in the cxl_cancel_auto_attach() function where an invalid negative index can be used to access an array. This out-of-bounds memory access could allow a local attacker to cause system instability or a denial of service (DoS).

cxl_cancel_auto_attach can use cxled pos as an index into p targets even when cxled pos contains a negative errno from cxl_region_sort_targets after cxl_calc_interleave_pos fails. This creates an out-of-bounds access in the CXL region auto attach cleanup path and may lead to a kernel crash or memory corruption if adjacent memory is read or later overwritten through the stale position. For the CVSS the PR:L is used for the paranoid score because a reduced capability local management context or service account that can influence CXL region auto assembly may be sufficient in some deployments, although normal CXL configuration is usually administrator controlled. The issue is not network reachable and requires local CXL management or device enumeration conditions. Impact is at least local denial of service and in the worst defensible case may affect confidentiality and integrity due to kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.