Cloudanix VulnDB

CVE-2026-93186

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux handles certain hardware mailbox commands can let attackers trigger huge memory requests that crash or destabilize the system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unbounded out.size parameter in CXL_MEM_SEND_COMMAND leads to excessive kvzalloc allocation in cxl_mbox_cmd_ctor, exceeding INT_MAX and triggering warnings, kernel taints, or panics under panic_on_warn.

Why it matters to the business

Systems using CXL hardware may experience unexpected crashes or instability from crafted mailbox commands, disrupting operations in affected Linux environments with potential availability loss.

How an attack unfolds

An attacker issues a CXL_MEM_SEND_COMMAND ioctl with an excessively large out.size value; the kernel proceeds to allocate a massive output buffer before any clamping occurs, exhausting resources or triggering the panic path.

How to fix it

Apply the upstream fix that clamps out.size to the mailbox payload size during allocation; rebuild and deploy updated kernel packages containing the corrected cxl/mbox code.

How to confirm the fix worked

Confirm the allocation clamp is present in cxl_mbox_cmd_ctor by inspecting the source or testing that oversized out.size values no longer produce warnings or allocations beyond payload limits.

Typical attack path

  1. Identify a system exposing CXL mailbox interfaces via /dev/cxl
  2. Craft a CXL_MEM_SEND_COMMAND request with out.size larger than payload size and INT_MAX
  3. Invoke the ioctl to trigger kvzalloc of the oversized buffer
  4. Observe kernel warning, taint, or panic depending on configuration

How to detect it

Review kernel logs for warnings or taints mentioning kvzalloc, cxl_mbox_cmd_ctor, or CXL_MEM_SEND_COMMAND with oversized allocations; correlate with process activity invoking CXL ioctls.

What your security team should do

  • Prioritize kernel updates on all CXL-enabled hosts within standard patching cycles
  • Audit workloads for use of CXL_MEM_SEND_COMMAND and restrict unprivileged access where possible
  • Enable monitoring for kernel warnings related to large memory allocations in cxl paths

The record

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxl_mbox_cmd_ctor() calls kvzalloc(out.size). A large out.size drives a huge allocation, above INT_MAX it WARNs and taints, and with panic_on_warn=1 it panics. The transport __cxl_pci_mbox_send_cmd() already clamps the response copy to min(out.size, payload_size, device len), so the output buffer is never written beyond payload_size. Clamp the allocation to payload_size too, matching the RAW path.

Affected packages

Ecosystem Package Introduced Fixed