{"id":"CVE-2026-74273","summary":"cxl/region: Block region delete during region creation","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Block region delete during region creation\n\nExpand the range lock, rename it \"regions_lock\", to disable region deletion\nin the critical period between construct_region() and attach_target(), as\nwell as the period between device_add() and registering the remove actions.\n\nOtherwise, userspace can confuse the kernel. It can violate the assumption\nthe region stays registered through the completion of cxl_add_to_region().\nIt can violate the assumption that devm_add_action_or_reset() is working\nwith a live 'struct cxl_region'.\n\nIt is ok for the region to disappear outside of those windows as that\nmirrors device hotplug flows where the proper locks are held.","modified":"2026-08-18T03:31:21.879806103Z","published":"2026-08-15T05:57:46.134Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74273.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d91feb88692e81b00cd22f0125cfcd04970b4a0b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74273.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74273"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a32320b71f085f8d82afedcf285f1682c8c00aed"},{"fixed":"b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8"},{"fixed":"d91feb88692e81b00cd22f0125cfcd04970b4a0b"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74273.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74273.json"}}],"schema_version":"1.9.0"}