SUSE CVE-2026-93096

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...

SUSE CVE-2026-92484

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix use-after-free in findposandways error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder...

SUSE CVE-2026-93077

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxlgetfeature reads a feature in a loop but passes a fixed sizeout as the output capacity every iteration. On the last partial iteration the buffer has less room...

SUSE CVE-2026-93078

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With...

SUSE CVE-2026-93079

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctlgetfeature sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout-payload, whic...

SUSE CVE-2026-93097

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

SUSE CVE-2026-93186

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

Linux Distros Unpatched Vulnerability : CVE-2026-93096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox...

Linux Distros Unpatched Vulnerability : CVE-2026-93186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size...

Linux Distros Unpatched Vulnerability : CVE-2026-93079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/features: Reject Get Feature count larger than the output buffer cxlctlgetfeature sizes its output buffer from the user's fwctlrpc.outlen, but the device is...

Linux Distros Unpatched Vulnerability : CVE-2026-93078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never check...

Linux Distros Unpatched Vulnerability : CVE-2026-93077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/features: Clamp Get Feature output size to the remaining buffer cxlgetfeature reads a feature in a loop but passes a fixed sizeout as the output capacity...

Linux Distros Unpatched Vulnerability : CVE-2026-92484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/region: Fix use-after-free in findposandways error path The error path releases its reference to a switch decoder before logging an error that includes the...

Linux Distros Unpatched Vulnerability : CVE-2026-93097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so...

DEBIAN-CVE-2026-93186

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

AZL-102953 CVE-2026-93186 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

CVE-2026-93186

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

DEBIAN-CVE-2026-93096

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...

DEBIAN-CVE-2026-93097

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

AZL-102980 CVE-2026-93097 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...