CVE-2026-93096

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mbox_mutex only serializes individual mailbox commands and is dropped between iterations of these loops. Nothing serializes the multi-part transfer as a whole. cxl_get_feature() and cxl_set_feature() are reachable concurrently from fwctl (per-fd RPCs run under a read-held registration lock) and from the EDAC scrub/ECS/repair paths, so two transfers to the same mailbox can interleave their parts and corrupt the device's transfer context. Add a per-mailbox feat_mutex and hold it across the whole transfer in both functions. It nests outside mbox_mutex (which is taken inside cxl_internal_send_cmd()), and is taken nowhere else, so no lock-ordering inversion is introduced.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/7682b617db1f19bc606b5f1badadcf1e63a87b14
https://git.kernel.org/stable/c/77b814c1832fde018c30357b4ec3fcdaa91a1c10

Configurations

No configuration.

History

17 Sep 2026, 17:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:18

Updated : 2026-09-17 17:18

NVD link : CVE-2026-93096

Mitre link : CVE-2026-93096

CVE.ORG link : CVE-2026-93096

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-93096", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5e5ac21f629de796ab5d598b59c5e468c6fe4f95", "lessThan": "7682b617db1f19bc606b5f1badadcf1e63a87b14", "versionType": "git"}, {"status": "affected", "version": "5e5ac21f629de796ab5d598b59c5e468c6fe4f95", "lessThan": "77b814c1832fde018c30357b4ec3fcdaa91a1c10", "versionType": "git"}], "programFiles": ["drivers/cxl/core/features.c", "drivers/cxl/core/mbox.c", "include/cxl/mailbox.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "7.2.6", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/cxl/core/features.c", "drivers/cxl/core/mbox.c", "include/cxl/mailbox.h"], "defaultStatus": "affected"}]}], "published": "2026-09-17T17:18:03.713", "references": [{"url": "https://git.kernel.org/stable/c/7682b617db1f19bc606b5f1badadcf1e63a87b14", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/77b814c1832fde018c30357b4ec3fcdaa91a1c10", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/features: Serialize multi-part Get/Set Feature transfers\n\nA Get or Set Feature payload larger than the mailbox payload size is\nsplit into several mailbox commands. mbox_mutex only serializes\nindividual mailbox commands and is dropped between iterations of these\nloops. Nothing serializes the multi-part transfer as a whole.\ncxl_get_feature() and cxl_set_feature() are reachable concurrently\nfrom fwctl (per-fd RPCs run under a read-held registration lock) and\nfrom the EDAC scrub/ECS/repair paths, so two transfers to the same\nmailbox can interleave their parts and corrupt the device's transfer\ncontext.\n\nAdd a per-mailbox feat_mutex and hold it across the whole transfer in\nboth functions. It nests outside mbox_mutex (which is taken inside\ncxl_internal_send_cmd()), and is taken nowhere else, so no lock-ordering\ninversion is introduced."}], "lastModified": "2026-09-17T17:18:03.713", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}