CVE-2026-92484

A flaw was found in the Linux kernel's cxl/region component. This use-after-free vulnerability occurs when an error path releases a reference to a switch decoder prematurely. If this is the last reference, the decoder can be freed before its name is accessed for error logging, potentially leading to system instability or crashes.

This vulnerability is rated as having a Moderate severity for Red Hat products because exploitation requires local access on systems configured with specialized Compute Express Link (CXL) hardware or emulated devices, with the impact limited to a denial of service. The flaw resides in an error-handling path during CXL region setup when releasing switch decoder references. Standard enterprise deployments lacking CXL interfaces are not exposed, and older distributions such as RHEL 8 and 9 do not include the vulnerable code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.