CVE-2026-90191

A flaw was found in the Linux kernel's mailbox: riscv-sbi-mpxy component. This vulnerability arises from insufficient validation of the SBI System Binary Interface return value, which dictates the number of bytes copied from shared memory into the RPMI RISC-V Platform Management Interface...

Ubuntu 22.04 LTS : OpenSBI vulnerability (USN-8853-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8853-1 advisory. It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial ...

USN-8853-1: OpenSBI vulnerability

It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service...

USN-8853-1 opensbi vulnerability

It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service...

PT-2026-104819

It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service...

PT-2026-104951

In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fs gc kthread in f2fs sb info Instead of allocating f2fs gc kthread dynamically, embed it in f2fs sb info. This simplifies lifetime management and prepares for fixing race conditions during teardown. - sbi store -...

SUSE CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

Linux Distros Unpatched Vulnerability : CVE-2026-90191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notificatio...

CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

DEBIAN-CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

EUVD-2026-81784

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191

CVE-2026-90191 affects the Linux kernel mailbox driver for RISC-V SBI Mpxy (RPMI notification handling). The SBI return value, which determines how many bytes are copied from shared memory into the RPMI notification buffer, is not validated against the negotiated shared-memory size before the cop...

CVE-2026-90191: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

PT-2026-94539

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the riscv-sbi-mpxy mailbox component where the SBI return value, which determines the number of bytes copied from shared memory into the RPMI notification buffer, is n...

CVE-2026-47780

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...

CVE-2026-47780

free5GC UDR (Unified Data Repository, versions 4.2.3 and earlier) contains an improper input validation flaw in HandleCreateEeSubscriptions and HandleQueryeesubscriptions within internal/sbi/api_datarepository.go. The ueId validation regex includes a trailing |.+ alternative that accepts any non-...

CVE-2026-47780 free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...

Linux Distros Unpatched Vulnerability : CVE-2026-89513

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents =...

CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...