CVE-2026-89570

The Linux kernel's CXL (Compute Express Link) machine-check-exception (MCE) notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though the handler only needs region state (the region's SPA range and extended linear cache size). This mismatched lifetime can leave the notifier referencing freed or NULL state when the memory device or endpoint goes away while the region persists, resulting in NULL pointer dereferences and use-after-free inside the kernel's MCE handler. A local attacker with low privileges who can induce or race the relevant memory-device teardown and machine-check handling on an affected CXL region could corrupt kernel memory, with the CVSS 3.1 score of 7.8 reflecting high impact to confidentiality, integrity, and availability (i.e., potential local privilege escalation or kernel crash). Only systems actually using CXL memory regions configured with an extended linear cache exercise the vulnerable code path. No public proof of concept is known and there is no evidence of exploitation in the wild.

What to do: Apply a kernel containing the fix, which moves the MCE notifier into 'struct cxl_region' and registers it only for regions with an extended linear cache, as soon as your distro ships a backport; check with your vendor for the patched kernel version. If you do not run CXL-backed memory regions with extended linear caches, the vulnerable path is not exercised and risk is minimal. In the interim, restrict local unprivileged shell access on CXL-equipped hosts and monitor kernel logs for oopses or warnings originating from the CXL/MCE handler paths.