CVE-2026-53295 - Vulnerability Details

- mailbox: add sanity check for channel array

Description

In the Linux kernel, the following vulnerability has been resolved:

mailbox: add sanity check for channel array

Fail gracefully if there is no channel array attached to the mailbox
controller. Otherwise the later dereference will cause an OOPS which
might not be seen because mailbox controllers might instantiate very
early. Remove the comment explaining the obvious while here.

Published: 2026-06-26

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A missing channel array in a mailbox controller can lead to a null pointer dereference in the Linux kernel, causing an OOPS that results in a kernel crash. This failure does not directly expose data but can be used to destabilize the system and create a denial of service condition.

Affected Systems

All Linux kernel releases that contain the mailbox driver without the sanity check are potentially affected. The issue is mitigated in the latest branches that include the commit adding the check.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been reported. The attack would require an attacker to trigger a null pointer dereference in the mailbox driver, which could happen during early boot or when the driver is loaded, leading to a system crash and denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2b6d83e2b8b7de82331a6a1dcd64b51020a6031c`	affected	< 5cc3300fab262b26c28bc2fc06df693410c3840b
`2b6d83e2b8b7de82331a6a1dcd64b51020a6031c`	affected	< 0f11444271110d9b5bc6316a153c6431abda899c
`2b6d83e2b8b7de82331a6a1dcd64b51020a6031c`	affected	< d44872a569b8fbacde457ff2587a775e5004bb79
`2b6d83e2b8b7de82331a6a1dcd64b51020a6031c`	affected	< 14aed0d4e58389cc6a88acf8610b12d3e476272b
`2b6d83e2b8b7de82331a6a1dcd64b51020a6031c`	affected	< 6362c4a7d7e21e68cd9aa04df7cde16befba3a4b
`2b6d83e2b8b7de82331a6a1dcd64b51020a6031c`	affected	< 9dd7489943324298bb0f385495795a82f1dd6507
`2b6d83e2b8b7de82331a6a1dcd64b51020a6031c`	affected	< 37792091ab28ba030fd8d61184c47d4d51294170
`2b6d83e2b8b7de82331a6a1dcd64b51020a6031c`	affected	< c1aad75595fb67edc7fda8af249d3b886efa1be9

Linux

affected

Version	Status	Constraints
`3.18`	affected	—
`0`	unaffected	< 3.18
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2b6d83e2b8b7de82331a6a1dcd64b51020a6031c,5cc3300fab262b26c28bc2fc06df693410c3840b)`	affected	code_commit	—
`[2b6d83e2b8b7de82331a6a1dcd64b51020a6031c,0f11444271110d9b5bc6316a153c6431abda899c)`	affected	code_commit	—
`[2b6d83e2b8b7de82331a6a1dcd64b51020a6031c,d44872a569b8fbacde457ff2587a775e5004bb79)`	affected	code_commit	—
`[2b6d83e2b8b7de82331a6a1dcd64b51020a6031c,14aed0d4e58389cc6a88acf8610b12d3e476272b)`	affected	code_commit	—
`[2b6d83e2b8b7de82331a6a1dcd64b51020a6031c,6362c4a7d7e21e68cd9aa04df7cde16befba3a4b)`	affected	code_commit	—
`[2b6d83e2b8b7de82331a6a1dcd64b51020a6031c,9dd7489943324298bb0f385495795a82f1dd6507)`	affected	code_commit	—
`[2b6d83e2b8b7de82331a6a1dcd64b51020a6031c,37792091ab28ba030fd8d61184c47d4d51294170)`	affected	code_commit	—
`[2b6d83e2b8b7de82331a6a1dcd64b51020a6031c,c1aad75595fb67edc7fda8af249d3b886efa1be9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.18`	affected	generic	—
`[0,3.18)`	unaffected	generic	—
`[5.10.258,5.10.*]`	unaffected	generic	—
`[5.15.209,5.15.*]`	unaffected	generic	—
`[6.1.175,6.1.*]`	unaffected	generic	—
`[6.6.141,6.6.*]`	unaffected	generic	—
`[6.12.91,6.12.*]`	unaffected	generic	—
`[6.18.33,6.18.*]`	unaffected	generic	—
`[7.0.10,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to the latest stable release that incorporates the mailbox sanity check commit.
If a kernel upgrade is not immediately possible, avoid using or loading mailbox controllers which might instantiate early during boot.
Monitor system logs for OOPS messages that could indicate the presence of the flaw and consider disabling the affected driver modules.

Generated by OpenCVE AI on June 29, 2026 at 15:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00123.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f11444271110d9b5bc6316a153c6431abda899c
https://git.kernel.org/stable/c/14aed0d4e58389cc6a88acf8610b12d3e476272b
https://git.kernel.org/stable/c/37792091ab28ba030fd8d61184c47d4d51294170
https://git.kernel.org/stable/c/5cc3300fab262b26c28bc2fc06df693410c3840b
https://git.kernel.org/stable/c/6362c4a7d7e21e68cd9aa04df7cde16befba3a4b
https://git.kernel.org/stable/c/9dd7489943324298bb0f385495795a82f1dd6507
https://git.kernel.org/stable/c/c1aad75595fb67edc7fda8af249d3b886efa1be9
https://git.kernel.org/stable/c/d44872a569b8fbacde457ff2587a775e5004bb79
https://lore.kernel.org/linux-cve-announce/2026062617-CVE-2026-53295-770b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53295
https://www.cve.org/CVERecord?id=CVE-2026-53295

History

Mon, 29 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Mon, 29 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-166
References		https://lore.kernel.org/linux-cve-announce/2026062617-CVE-2026-53295-770b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53295 https://www.cve.org/CVERecord?id=CVE-2026-53295
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Fri, 26 Jun 2026 22:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 26 Jun 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers might instantiate very early. Remove the comment explaining the obvious while here.
Title		mailbox: add sanity check for channel array
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f11444271110d9b5bc6316a153c6431abda899c https://git.kernel.org/stable/c/14aed0d4e58389cc6a88acf8610b12d3e476272b https://git.kernel.org/stable/c/37792091ab28ba030fd8d61184c47d4d51294170 https://git.kernel.org/stable/c/5cc3300fab262b26c28bc2fc06df693410c3840b https://git.kernel.org/stable/c/6362c4a7d7e21e68cd9aa04df7cde16befba3a4b https://git.kernel.org/stable/c/9dd7489943324298bb0f385495795a82f1dd6507 https://git.kernel.org/stable/c/c1aad75595fb67edc7fda8af249d3b886efa1be9 https://git.kernel.org/stable/c/d44872a569b8fbacde457ff2587a775e5004bb79

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-26T19:40:53.670Z

Updated: 2026-06-26T19:40:53.670Z

Reserved: 2026-06-09T07:44:35.396Z

Link: CVE-2026-53295

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-06-26T00:00:00Z

Links: CVE-2026-53295 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-29T15:30:05Z

Weaknesses

CWE-166
Improper Handling of Missing Special Element

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object