Cloudanix VulnDB

CVE-2026-93096

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing issue in how the Linux kernel manages certain hardware device commands could let operations interfere with each other and cause crashes or corruption.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in cxl_get_feature() and cxl_set_feature() allows concurrent multi-part mailbox transfers to interleave because mbox_mutex is released between iterations, corrupting device transfer context when reached from fwctl and EDAC paths.

Why it matters to the business

Potential kernel crashes, data corruption in CXL device management, or denial of service on systems using CXL hardware; low exploitability reduces immediate risk but affects stability in high-availability environments.

How an attack unfolds

An attacker with local access triggers concurrent calls to feature get/set operations from different kernel paths or user-space via fwctl, causing partial transfers to interleave and corrupt mailbox state without needing network access or elevated privileges beyond local execution.

How to fix it

Apply the upstream fix that adds a per-mailbox feat_mutex held across the entire multi-part transfer in cxl_get_feature() and cxl_set_feature(); rebuild and deploy updated kernel packages containing the patch.

How to confirm the fix worked

Confirm the feat_mutex acquisition surrounds the full transfer loop in both functions and verify no concurrent access paths remain unprotected; test with concurrent fwctl and EDAC workloads.

Typical attack path

  1. Obtain local code execution on a Linux system with CXL support
  2. Trigger concurrent fwctl RPCs and EDAC scrub/repair operations targeting the same mailbox
  3. Interleave multi-part Get/Set Feature commands to corrupt transfer context
  4. Induce kernel panic or device malfunction

How to detect it

Review kernel logs for CXL mailbox errors or panics during concurrent feature operations; inspect call traces involving cxl_get_feature, cxl_set_feature, and mbox commands for signs of interleaved transfers.

What your security team should do

  • Prioritize kernel updates on CXL-enabled systems within standard patch cycles
  • Monitor upstream stable kernel releases for backports
  • Restrict untrusted local access on systems exposing CXL mailboxes until patched

The record

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mbox_mutex only serializes individual mailbox commands and is dropped between iterations of these loops. Nothing serializes the multi-part transfer as a whole. cxl_get_feature() and cxl_set_feature() are reachable concurrently from fwctl (per-fd RPCs run under a read-held registration lock) and from the EDAC scrub/ECS/repair paths, so two transfers to the same mailbox can interleave their parts and corrupt the device's transfer context. Add a per-mailbox feat_mutex and hold it across the whole transfer in both functions. It nests outside mbox_mutex (which is taken inside cxl_internal_send_cmd()), and is taken nowhere else, so no lock-ordering inversion is introduced.

Affected packages

Ecosystem Package Introduced Fixed