{"id":"CVE-2026-93186","summary":"cxl/mbox: Clamp mailbox output allocation to the payload size","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mbox: Clamp mailbox output allocation to the payload size\n\nCXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload\nsize but leaves out.size unbounded, then cxl_mbox_cmd_ctor() calls\nkvzalloc(out.size). A large out.size drives a huge allocation, above\nINT_MAX it WARNs and taints, and with panic_on_warn=1 it panics.\n\nThe transport __cxl_pci_mbox_send_cmd() already clamps the response copy\nto min(out.size, payload_size, device len), so the output buffer is\nnever written beyond payload_size. Clamp the allocation to payload_size\ntoo, matching the RAW path.","modified":"2026-09-19T03:47:22.755624678Z","published":"2026-09-17T16:12:12.121Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93186.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/31d4841eca7c4b75751ca96d24339e19303337f2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8a13db9f899d149c3aab24abcb668121cfda5a4f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b4e11c731d6bee3b87315e055a1ca417c92dc1fc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f5d2bbf0300f46307948864fbb97bce5097f4fe2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93186.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93186"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"583fa5e71caeb79e04e477e9837e2f7fa53b71e4"},{"fixed":"f5d2bbf0300f46307948864fbb97bce5097f4fe2"},{"fixed":"31d4841eca7c4b75751ca96d24339e19303337f2"},{"fixed":"b4e11c731d6bee3b87315e055a1ca417c92dc1fc"},{"fixed":"8a13db9f899d149c3aab24abcb668121cfda5a4f"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93186.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93186.json"}}],"schema_version":"1.9.0"}