CVE-2026-90191mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory size before that copy. The event walker also uses a reversed loop condition and can inspect a short event record. Validate the complete notification length before copying it, iterate only while a full event header remains, and stop when a declared event payload extends beyond the copied notification data.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 before cbc24bce70dfd91c7b2f53b4fa896e9a4b6d6a6b; from bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 before c7bc5e7677bcda7a446d63b989cfaa3fe91d6b76; from bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 before 11d5af151bcbe78f5a579e0faecd3be9cea0399a | CNA record |
References
- https://git.kernel.org/stable/c/cbc24bce70dfd91c7b2f53b4fa896e9a4b6d6a6b
- https://git.kernel.org/stable/c/c7bc5e7677bcda7a446d63b989cfaa3fe91d6b76
- https://git.kernel.org/stable/c/11d5af151bcbe78f5a579e0faecd3be9cea0399a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.