{"id":"CVE-2026-97423","revision":"b39bb2d8ccd74729b8fdd84ed2753f95","records":[{"revision":"b39bb2d8ccd74729b8fdd84ed2753f95","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97423","aliases":[],"title":"cxl/region: Validate partition index before array access","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Validate partition index before array access\n\nconstruct_region() reads cxled->part and uses it to index\ncxlds->part[] without checking for a negative value. If the\npartition was never resolved, part remains at its initial value\nof -1, causing an out-of-bounds array access.\n\nAdd a guard to return -EBUSY when part is negative.\n\nThe check was dropped during a merge.","state":0,"publishedAt":"2026-09-24T16:03:35.458+00:00","modifiedAt":"2026-09-25T12:43:59.015+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/cxl/core/region.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b6faa9c613787b894913638a76030018f6d62d54\",\n                            \"lessThan\": \"06322da06116f1ee52271dd4d84dc69580087df7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b6faa9c613787b894913638a76030018f6d62d54\",\n                            \"lessThan\": \"16329b510f76e5b824e05bf8add8b29850f1f16f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/cxl/core/region.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/06322da06116f1ee52271dd4d84dc69580087df7","https://git.kernel.org/stable/c/16329b510f76e5b824e05bf8add8b29850f1f16f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97423","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97423","identifiers":["CVE-2026-97423"]},"retained":false,"historicalAffected":[]}],"coverage":[]}