cxl/mce: Make the MCE notifier per-region

Answer in brief

CVE-2026-89570 records a Unknown severity vulnerability in cxl/mce: Make the MCE notifier per-region. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 11, 2026Updated Sep 11, 2026Source checked Sep 11, 2026First seen by HOL Sep 11, 2026Material review Sep 11, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=516e5bd0b6bf4ae1ad072df637b428a737c3c870 <5563db13c9528a56c7161260ec75ec8690dc5608 \|\| >=516e5bd0b6bf4ae1ad072df637b428a737c3c870 <491d8c9ac98d55073bda778f88a5248d4cce3fa0 \|\| >=516e5bd0b6bf4ae1ad072df637b428a737c3c870 <775d0f4558f4cec0ee0c8966595d1add1791f36e	5563db13c9528a56c7161260ec75ec8690dc5608, 491d8c9ac98d55073bda778f88a5248d4cce3fa0, 775d0f4558f4cec0ee0c8966595d1add1791f36e
Linux/Linuxgeneric	6.15	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 5563db13c9528a56c7161260ec75ec8690dc5608 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size). Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage. Remove cxl_port_get_spa_cache_alias() as it is now dead code. [ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]

Quoted source text, attributed separately from HOL analysis.