Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-93186

cxl/mbox: Clamp mailbox output allocation to the payload size

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxl_mbox_cmd_ctor() calls kvzalloc(out.size). A large out.size drives a huge allocation, above INT_MAX it WARNs and taints, and with panic_on_warn=1 it panics. The transport __cxl_pci_mbox_send_cmd() already clamps the response copy to min(out.size, payload_size, device len), so the output buffer is never written beyond payload_size. Clamp the allocation to payload_size too, matching the RAW path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 583fa5e71caeb79e04e477e9837e2f7fa53b71e4 to < 123f6d154253939ce38f0ec0b6d1ba67f870e01faffected
  • 583fa5e71caeb79e04e477e9837e2f7fa53b71e4 to < d2d40574b9b272ade32d0d77b140d990e7547f5faffected
  • 583fa5e71caeb79e04e477e9837e2f7fa53b71e4 to < f5d2bbf0300f46307948864fbb97bce5097f4fe2affected
  • 583fa5e71caeb79e04e477e9837e2f7fa53b71e4 to < 31d4841eca7c4b75751ca96d24339e19303337f2affected
  • 583fa5e71caeb79e04e477e9837e2f7fa53b71e4 to < b4e11c731d6bee3b87315e055a1ca417c92dc1fcaffected
  • 583fa5e71caeb79e04e477e9837e2f7fa53b71e4 to < 8a13db9f899d149c3aab24abcb668121cfda5a4faffected

Linux Linux

Default version status: affected

  • 5.12affected
  • 0 to < 5.12unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References