CVE-2026-89570

A flaw was found in the Linux kernel's Compute Express Link (CXL) subsystem. Lifetime issues with the CXL Machine Check Exception (MCE) notifier can lead to NULL dereferences and use-after-free vulnerabilities in the MCE handler. This could allow an attacker to cause system instability or a denial of service.

A lifetime bug in the CXL MCE notifier can make the MCE handler use a notifier object tied to cxl_memdev_state after the relevant memory device or endpoint state is no longer valid. This can result in a NULL-pointer dereference or a use-after-free when a machine check is handled for a CXL region with an extended linear cache. For the CVSS the PR:L is used for the paranoid score because a reduced-capability root, service account, or delegated management context may be able to influence CXL region or device lifetime without full host control. The issue is not network reachable and requires local access plus a specific CXL hardware and region configuration. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel use-after-free, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.