SUSE CVE-2026-93097

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

SUSE CVE-2026-93186

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

Linux Distros Unpatched Vulnerability : CVE-2026-93186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size...

Linux Distros Unpatched Vulnerability : CVE-2026-93097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so...

AZL-102953 CVE-2026-93186 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

CVE-2026-93186

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

AZL-102980 CVE-2026-93097 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

DEBIAN-CVE-2026-93097

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

CVE-2026-93097

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

CVE-2026-93186 cxl/mbox: Clamp mailbox output allocation to the payload size

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

CVE-2026-93186 cxl/mbox: Clamp mailbox output allocation to the payload size

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

EUVD-2026-82294

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

CVE-2026-93186

CVE-2026-93186 affects the Linux kernel CXL mailbox (cxl/mbox) subsystem. The CXL_MEM_SEND_COMMAND ioctl bounds the user-supplied in.size to the mailbox payload size but leaves out.size unbounded. The subsequent call to kvzalloc(out.size) in cxl_mbox_cmd_ctor() allows a user-controlled oversized ...

CVE-2026-93097 cxl/mbox: Break poison list loop on an empty payload

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

CVE-2026-93097 cxl/mbox: Break poison list loop on an empty payload

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

CVE-2026-93097

CVE-2026-93097 affects the Linux kernel CXL/mbox subsystem's poison list handling. A CXL device that returns count == 0 with CXL_POISON_FLAG_MORE set on every iteration causes an infinite do/while loop while holding poison.mutex . This hangs the sysfs-triggered poison scan thread and blocks all s...

EUVD-2026-82205

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

PT-2026-94982

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CXL mailbox implementation where the out.size parameter is not bounded. When CXL MEM SEND COMMAND is used, the cxl mbox cmd ctor function calls kvzallocout.size...

CVE-2026-93186: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

CVE-2026-93097: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...