622 matches found
CVE-2026-93097
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...
CVE-2026-93096
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...
DEBIAN-CVE-2026-93078
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With...
DEBIAN-CVE-2026-93079
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctlgetfeature sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout-payload, whic...
CVE-2026-93079
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctlgetfeature sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout-payload, whic...
CVE-2026-93078
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With...
DEBIAN-CVE-2026-92484
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix use-after-free in findposandways error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder...
AZL-102180 CVE-2026-92484 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix use-after-free in findposandways error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder...
CVE-2026-92484
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix use-after-free in findposandways error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder...
CVE-2026-93186 cxl/mbox: Clamp mailbox output allocation to the payload size
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...
EUVD-2026-82294
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...
CVE-2026-93186
CVE-2026-93186 affects the Linux kernel CXL mailbox (cxl/mbox) subsystem. The CXL_MEM_SEND_COMMAND ioctl bounds the user-supplied in.size to the mailbox payload size but leaves out.size unbounded. The subsequent call to kvzalloc(out.size) in cxl_mbox_cmd_ctor() allows a user-controlled oversized ...
CVE-2026-93186 cxl/mbox: Clamp mailbox output allocation to the payload size
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...
CVE-2026-93097 cxl/mbox: Break poison list loop on an empty payload
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...
CVE-2026-93097
CVE-2026-93097 affects the Linux kernel CXL/mbox subsystem's poison list handling. A CXL device that returns count == 0 with CXL_POISON_FLAG_MORE set on every iteration causes an infinite do/while loop while holding poison.mutex . This hangs the sysfs-triggered poison scan thread and blocks all s...
CVE-2026-93097 cxl/mbox: Break poison list loop on an empty payload
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...
EUVD-2026-82205
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...
CVE-2026-93096 cxl/features: Serialize multi-part Get/Set Feature transfers
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...
CVE-2026-93096
CVE-2026-93096 is a concurrency bug in the Linux kernel's CXL (Compute Express Link) features subsystem . When a Get or Set Feature payload exceeds the mailbox payload size, it is split across multiple mailbox commands. The existing mbox_mutex serializes only individual commands and is dropped be...
CVE-2026-93096 cxl/features: Serialize multi-part Get/Set Feature transfers
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...