CVE-2026-93096

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists where Get or Set Feature payloads exceeding the mailbox payload size are split into multiple mailbox commands. Because the mbox mutex only serializes individual commands and is released between iterations, the entire multi-part transfer is not serialized. This allows concurrent access to cxl get feature() and cxl set feature() from fwctl and EDAC scrub/ECS/repair paths, potentially causing interleaved transfers to the same mailbox and corrupting the device transfer context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.