CVE-2026-74274

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cxl/region: Fill first free targets[] slot during auto-discovery

Any invalid endpoint decoder pointer in the target array of an active

region is not allowed by cxl driver. This means cxl driver always

assumes the first p->nr_targets entries of the target array in an

auto-assembly region are valid. However, there are scenarios that could

leave NULL endpoint decoder pointer holes in the target array.

1. When cxl_cancel_auto_attach() removes an endpoint decoder from a

target array, the target slot is set to NULL. If the removed endpoint

decoder is not the last element in the target array, the target array

will contain a NULL hole.

2. When a auto-assembly region removes an assigned endpoint decoder, if

the removed endpoint decoder is not the last element in the target

array, always remains a NULL hole in the target array.

When a NULL pointer hole exists in a region's target array, it

introduces two pote

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References