CVE-2026-93096

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cxl/features: Serialize multi-part Get/Set Feature transfers

A Get or Set Feature payload larger than the mailbox payload size is

split into several mailbox commands. mbox_mutex only serializes

individual mailbox commands and is dropped between iterations of these

loops. Nothing serializes the multi-part transfer as a whole.

cxl_get_feature() and cxl_set_feature() are reachable concurrently

from fwctl (per-fd RPCs run under a read-held registration lock) and

from the EDAC scrub/ECS/repair paths, so two transfers to the same

mailbox can interleave their parts and corrupt the device's transfer

context.

Add a per-mailbox feat_mutex and hold it across the whole transfer in

both functions. It nests outside mbox_mutex (which is taken inside

cxl_internal_send_cmd()), and is taken nowhere else, so no lock-ordering

inversion is introduced.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References