Ubuntu 22.04 LTS : OpenSBI vulnerability (USN-8853-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8853-1 advisory. It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial ...

USN-8853-1 opensbi vulnerability

It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service...

USN-8853-1: OpenSBI vulnerability

It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-90191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notificatio...

CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

DEBIAN-CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191

CVE-2026-90191 affects the Linux kernel mailbox driver for RISC-V SBI Mpxy (RPMI notification handling). The SBI return value, which determines how many bytes are copied from shared memory into the RPMI notification buffer, is not validated against the negotiated shared-memory size before the cop...

EUVD-2026-81784

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-47780

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...

CVE-2026-47780

free5GC UDR (Unified Data Repository, versions 4.2.3 and earlier) contains an improper input validation flaw in HandleCreateEeSubscriptions and HandleQueryeesubscriptions within internal/sbi/api_datarepository.go. The ueId validation regex includes a trailing |.+ alternative that accepts any non-...

CVE-2026-47780 free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...

Linux Distros Unpatched Vulnerability : CVE-2026-89513

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents =...

CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

SUSE CVE-2026-80822

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null check for devmkasprintf Add a check to see if devmkasprintf is not NULL in mchpipcgetclusteraggrirq, returning -ENOMEM if the function failed...

CVE-2026-80822

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null check for devmkasprintf Add a check to see if devmkasprintf is not NULL in mchpipcgetclusteraggrirq, returning -ENOMEM if the function failed...

AZL-99686 CVE-2026-80822 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null check for devmkasprintf Add a check to see if devmkasprintf is not NULL in mchpipcgetclusteraggrirq, returning -ENOMEM if the function failed...

EUVD-2026-71264

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null check for devmkasprintf Add a check to see if devmkasprintf is not NULL in mchpipcgetclusteraggrirq, returning -ENOMEM if the function failed...

CVE-2026-80822

CVE-2026-80822 affects the Linux kernel's mchp-ipc-sbi mailbox driver. The root cause is a missing null check on the return value of devm_kasprintf() in the function mchp_ipc_get_cluster_aggr_irq() . Without this check, a failed allocation could lead to a NULL pointer dereference. The fix adds a ...