CVE-2026-89570
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the CXL MCE notifier was registered per memory device and stored in struct cxl_memdev_state, even though it only needs region state. This caused lifetime issues leading to NULL dereferences and use-after-free in the MCE handler. The fix moves the notifier into struct cxl_region and registers it from cxl_region_probe() only for regions with an extended linear cache.
Risk Assessment
NULL dereferences and use-after-free in MCE handling can lead to kernel crashes or potential kernel-context code execution.
Recommendation
Update the Linux kernel to a version containing the fix that moves the CXL MCE notifier into the region structure.
Related vulnerabilities
- CVE-2026-44179Critical
The `excerpt-include` macro in XWiki Remote Macros does not properly escape the included page's title and executes `excerpt` content with the macro's rights. Both the title handling and the rendering of `excerpt` content into XWiki syntax allow syntax injection. Any user able to edit a page, even without script rights, can supply executable macro syntax and cause remote code execution when the page is included.
- CVE-2026-115968Critical
A deserialization of untrusted data vulnerability in the Ultimate Member WordPress plugin allows Object Injection. Affects versions up to and including 2.13.1.
- CVE-2026-105420Critical
Wing FTP Server does not verify the user's base folder, allowing an attacker with admin privileges to add user directories via scripts that escape the base folder. This enables file writes on the system and potential remote code execution with process owner privileges, and with sudo-based installation files are created as root. Fixed in version 8.2.6.
- CVE-2026-67074Critical
HCL BigFix AEX is affected by a Remote Code Execution (RCE) vulnerability. An attacker may execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.
- CVE-2026-115904Critical
Topluyo Desktop for Linux prior to version 2026.9.2410 unsafely processes user-controlled URLs, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
- CVE-2026-115607Critical
The Crowd Favorite DXP ToolKit plugin contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects DXP ToolKit versions from n/a through 2.0.1.
- CVE-2026-111411Critical
The Aman FunnelKit Automations (wp-marketing-automations) plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects FunnelKit Automations versions from n/a through 3.8.5.2.
- CVE-2026-118477Critical
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. An authenticated attacker can execute arbitrary commands with www-data privileges. Fixed in version 2026061802.
- CVE-2026-114278Critical
The che-machine-exec service constructs a shell command by concatenating user-controlled input (username and namespace fields from /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c invocation without escaping. When authentication is disabled (default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec can access via shell command substitution.
- CVE-2026-112197Critical
The NoviGest Desktop App's Java RMI service lacks authentication in critical functions. An attacker with network access can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained to execute operating system commands on the server.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size). Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage. Remove cxl_port_get_spa_cache_alias() as it is now dead code. [ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]
Vulnerability data from NVD (NIST) · CISA KEV · EPSS