CVE-2026-90191
Description
In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory size before that copy. The event walker also uses a reversed loop condition and can inspect a short event record. Validate the complete notification length before copying it, iterate only while a full event header remains, and stop when a declared event payload extends beyond the copied notification data.
How to fix
- Linux Linuxcbc24bce70dfd91c7b2f53b4fa896e9a4b6d6a6b, c7bc5e7677bcda7a446d63b989cfaa3fe91d6b76, 11d5af151bcbe78f5a579e0faecd3be9cea0399a or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 ≤ v < cbc24bce70dfd91c7b2f53b4fa896e9a4b6d6a6b, bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 ≤ v < c7bc5e7677bcda7a446d63b989cfaa3fe91d6b76, bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 ≤ v < 11d5af151bcbe78f5a579e0faecd3be9cea0399a, 6.18 | cbc24bce70dfd91c7b2f53b4fa896e9a4b6d6a6b, c7bc5e7677bcda7a446d63b989cfaa3fe91d6b76, 11d5af151bcbe78f5a579e0faecd3be9cea0399a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.