CVE-2026-74274

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the CXL driver where NULL endpoint decoder pointer holes can be left in the target array of an active auto-assembly region. This occurs when cxl cancel auto attach() removes an endpoint decoder or when an auto-assembly region removes an assigned endpoint decoder that is not the last element in the array. These NULL holes lead to two primary issues: accessing an endpoint decoder via a NULL pointer, which triggers a general protection fault, and an incorrect count of valid endpoint decoders since the driver relies on the p->nr targets variable, which includes NULL pointers. The issue is specifically related to the cxl region attach auto() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.