CVE-2026-93097

Summary

In the Linux kernel, the following vulnerability has been resolved:

cxl/mbox: Break poison list loop on an empty payload

A device that returns count == 0 with CXL_POISON_FLAG_MORE set on every iteration never advances nr_records, so the max_errors guard never trips and the do/while loops forever while holding poison.mutex. That hangs the sysfs-triggered scan thread and blocks all subsequent poison operations on the device. The existing "Protect against an uncleared _FLAG_MORE" guard was intended to bound a misbehaving device but does not cover the count == 0 case.

Stop the loop on an empty payload so a malfunctioning or malicious device cannot wedge the poison scan.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxed83f7ca398b3798b82c1d5d1113011c0e5a2198 < 86771c105293ca26bfcc320b4f60d32c137b54aaaffected
LinuxLinuxed83f7ca398b3798b82c1d5d1113011c0e5a2198 < 42eab80981f4d2ac820e253e80ecf92f8cd91f69affected
LinuxLinuxed83f7ca398b3798b82c1d5d1113011c0e5a2198 < 6ad491cef1a812cf7b53aa769cd8869516c47362affected
LinuxLinuxed83f7ca398b3798b82c1d5d1113011c0e5a2198 < e77594e0cea67ab1c2317a27aa77a744e26ad6a6affected
LinuxLinuxed83f7ca398b3798b82c1d5d1113011c0e5a2198 < 8b301c4afbce4bc3f94528441d8d5ce1366504adaffected
LinuxLinux6.4affected
LinuxLinux0 < 6.4unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References