CVE-2026-93097cxl/mbox: Break poison list loop on an empty payload
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXL_POISON_FLAG_MORE set on every iteration never advances nr_records, so the max_errors guard never trips and the do/while loops forever while holding poison.mutex. That hangs the sysfs-triggered scan thread and blocks all subsequent poison operations on the device. The existing "Protect against an uncleared _FLAG_MORE" guard was intended to bound a misbehaving device but does not cover the count == 0 case. Stop the loop on an empty payload so a malfunctioning or malicious device cannot wedge the poison scan.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ed83f7ca398b3798b82c1d5d1113011c0e5a2198 before 86771c105293ca26bfcc320b4f60d32c137b54aa; from ed83f7ca398b3798b82c1d5d1113011c0e5a2198 before 42eab80981f4d2ac820e253e80ecf92f8cd91f69; from ed83f7ca398b3798b82c1d5d1113011c0e5a2198 before 6ad491cef1a812cf7b53aa769cd8869516c47362; from ed83f7ca398b3798b82c1d5d1113011c0e5a2198 before e77594e0cea67ab1c2317a27aa77a744e26ad6a6; from ed83f7ca398b3798b82c1d5d1113011c0e5a2198 before 8b301c4afbce4bc3f94528441d8d5ce1366504ad | CNA record |
References
- https://git.kernel.org/stable/c/86771c105293ca26bfcc320b4f60d32c137b54aa
- https://git.kernel.org/stable/c/42eab80981f4d2ac820e253e80ecf92f8cd91f69
- https://git.kernel.org/stable/c/6ad491cef1a812cf7b53aa769cd8869516c47362
- https://git.kernel.org/stable/c/e77594e0cea67ab1c2317a27aa77a744e26ad6a6
- https://git.kernel.org/stable/c/8b301c4afbce4bc3f94528441d8d5ce1366504ad
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.