{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97957", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.205Z", "datePublished": "2026-09-25T10:23:03.153Z", "dateUpdated": "2026-09-25T14:41:45.351Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T14:41:45.351Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48). However, this allows the last segment\n(seq_id=42) to carry a full 48-byte payload, writing to offset\n42*48=2016 for 48 bytes (ending at byte 2064). The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space. Apply the same fix to the\nhinic driver."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed input is a mailbox header (SEQID/SEG_LEN) and 48-byte body that a VF driver writes into its own mailbox registers. The hardware delivers it to the PF's hinic_mbox_func_aeqe_handler() -> recv_mbox_handler(). The attacker is code running in a guest that owns an SR-IOV VF (or a local driver), not a remote network peer, so this is local access.\nAC:L - The attacker sends segments seq_id 0..42 in order, each with seg_len=48. check_mbox_seq_id_and_seg_len() accepts all of them, and the memcpy at offset 42*48 overflows every time. The only setup is a VF assigned to the attacker's VM, which is the standard SR-IOV passthrough deployment. Nothing depends on timing or state outside the attacker's control.\nPR:L - Writing raw mailbox headers needs kernel control of the VF, i.e. root inside the guest. A VM tenant always has that, and it gives no privilege on the host whose PF driver is corrupted. The random id checked by check_vf_mbox_random_id() is given to every genuine VF, so it does not stop a hostile VF driver.\nUI:N - The PF host processes the mailbox message on its own from the AEQ handler. Nobody on the host has to do anything.\nS:C - The bug is in a guest-controlled VF's messages, but the overflow corrupts the host kernel heap in the PF driver (recv_mbox->mbox, kzalloc(2048)). That crosses the guest-to-host boundary, like a VM escape.\nC:H - Overwriting the first 16 bytes of the neighbouring kmalloc-2048 object with attacker-chosen data can corrupt pointers or length fields in that object. That is a normal route to reading arbitrary host kernel memory.\nI:H - recv_mbox_handler() copies 16 attacker-chosen bytes from the mailbox body past the end of the 2048-byte receive buffer. This is a controlled heap out-of-bounds write in the host kernel, which can lead to control-flow hijack.\nA:H - The guest can repeat the corruption of the neighbouring host heap object at will, crashing or panicking the host kernel. That takes down every tenant on the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"], "versions": [{"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "eca54a092d5f7b497b458ff5a6f66d4f7bfb6674", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "513f7b16ed0cffae9348151c72bed17c7073096f", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "5d4d985957434867bbe85e4fa5e638f3e48ad522", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.3-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/eca54a092d5f7b497b458ff5a6f66d4f7bfb6674"}, {"url": "https://git.kernel.org/stable/c/9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5"}, {"url": "https://git.kernel.org/stable/c/513f7b16ed0cffae9348151c72bed17c7073096f"}, {"url": "https://git.kernel.org/stable/c/5d4d985957434867bbe85e4fa5e638f3e48ad522"}], "title": "net: hinic: fix mailbox segment buffer overflow", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "eca54a092d5f7b497b458ff5a6f66d4f7bfb6674", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "513f7b16ed0cffae9348151c72bed17c7073096f", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "5d4d985957434867bbe85e4fa5e638f3e48ad522", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48). However, this allows the last segment\n(seq_id=42) to carry a full 48-byte payload, writing to offset\n42*48=2016 for 48 bytes (ending at byte 2064). The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space. Apply the same fix to the\nhinic driver."}], "id": "CVE-2026-97957", "lastModified": "2026-09-25T15:18:03.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:23.367", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/513f7b16ed0cffae9348151c72bed17c7073096f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d4d985957434867bbe85e4fa5e638f3e48ad522"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eca54a092d5f7b497b458ff5a6f66d4f7bfb6674"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}