CVE-2026-97957

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97957", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.205Z", "datePublished": "2026-09-25T10:23:03.153Z", "dateUpdated": "2026-10-19T09:11:23.333Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:11:23.333Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48). However, this allows the last segment\n(seq_id=42) to carry a full 48-byte payload, writing to offset\n42*48=2016 for 48 bytes (ending at byte 2064). The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space. Apply the same fix to the\nhinic driver."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed input is a mailbox header (SEQID/SEG_LEN) and 48-byte body that a VF driver writes into its own mailbox registers. The hardware delivers it to the PF's hinic_mbox_func_aeqe_handler() -> recv_mbox_handler(). The attacker is code running in a guest that owns an SR-IOV VF (or a local driver), not a remote network peer, so this is local access.\nAC:L - The attacker sends segments seq_id 0..42 in order, each with seg_len=48. check_mbox_seq_id_and_seg_len() accepts all of them, and the memcpy at offset 42*48 overflows every time. The only setup is a VF assigned to the attacker's VM, which is the standard SR-IOV passthrough deployment. Nothing depends on timing or state outside the attacker's control.\nPR:L - Writing raw mailbox headers needs kernel control of the VF, i.e. root inside the guest. A VM tenant always has that, and it gives no privilege on the host whose PF driver is corrupted. The random id checked by check_vf_mbox_random_id() is given to every genuine VF, so it does not stop a hostile VF driver.\nUI:N - The PF host processes the mailbox message on its own from the AEQ handler. Nobody on the host has to do anything.\nS:C - The bug is in a guest-controlled VF's messages, but the overflow corrupts the host kernel heap in the PF driver (recv_mbox->mbox, kzalloc(2048)). That crosses the guest-to-host boundary, like a VM escape.\nC:H - Overwriting the first 16 bytes of the neighbouring kmalloc-2048 object with attacker-chosen data can corrupt pointers or length fields in that object. That is a normal route to reading arbitrary host kernel memory.\nI:H - recv_mbox_handler() copies 16 attacker-chosen bytes from the mailbox body past the end of the 2048-byte receive buffer. This is a controlled heap out-of-bounds write in the host kernel, which can lead to control-flow hijack.\nA:H - The guest can repeat the corruption of the neighbouring host heap object at will, crashing or panicking the host kernel. That takes down every tenant on the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"], "versions": [{"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "7cc974799fde846eda2d8f00ad4f8e1810eb0499", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "72be1fd5d256dde748c0905c5e1749a119cad5bd", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "c622bbc212207d7c6bbd69dd88f0c3a3f5853d16", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "eca54a092d5f7b497b458ff5a6f66d4f7bfb6674", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "513f7b16ed0cffae9348151c72bed17c7073096f", "status": "affected", "versionType": "git"}, {"version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "lessThan": "5d4d985957434867bbe85e4fa5e638f3e48ad522", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7cc974799fde846eda2d8f00ad4f8e1810eb0499"}, {"url": "https://git.kernel.org/stable/c/8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920"}, {"url": "https://git.kernel.org/stable/c/72be1fd5d256dde748c0905c5e1749a119cad5bd"}, {"url": "https://git.kernel.org/stable/c/c622bbc212207d7c6bbd69dd88f0c3a3f5853d16"}, {"url": "https://git.kernel.org/stable/c/eca54a092d5f7b497b458ff5a6f66d4f7bfb6674"}, {"url": "https://git.kernel.org/stable/c/9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5"}, {"url": "https://git.kernel.org/stable/c/513f7b16ed0cffae9348151c72bed17c7073096f"}, {"url": "https://git.kernel.org/stable/c/5d4d985957434867bbe85e4fa5e638f3e48ad522"}], "title": "net: hinic: fix mailbox segment buffer overflow", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7cc974799fde846eda2d8f00ad4f8e1810eb0499", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "72be1fd5d256dde748c0905c5e1749a119cad5bd", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "c622bbc212207d7c6bbd69dd88f0c3a3f5853d16", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "eca54a092d5f7b497b458ff5a6f66d4f7bfb6674", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "513f7b16ed0cffae9348151c72bed17c7073096f", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}, {"lessThan": "5d4d985957434867bbe85e4fa5e638f3e48ad522", "status": "affected", "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48). However, this allows the last segment\n(seq_id=42) to carry a full 48-byte payload, writing to offset\n42*48=2016 for 48 bytes (ending at byte 2064). The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space. Apply the same fix to the\nhinic driver."}], "id": "CVE-2026-97957", "lastModified": "2026-10-19T10:17:46.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:23.367", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/513f7b16ed0cffae9348151c72bed17c7073096f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d4d985957434867bbe85e4fa5e638f3e48ad522"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72be1fd5d256dde748c0905c5e1749a119cad5bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7cc974799fde846eda2d8f00ad4f8e1810eb0499"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c622bbc212207d7c6bbd69dd88f0c3a3f5853d16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eca54a092d5f7b497b458ff5a6f66d4f7bfb6674"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: hinic: fix mailbox segment buffer overflow", "id": "2541091", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541091"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: hinic: fix mailbox segment buffer overflow\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48). However, this allows the last segment\n(seq_id=42) to carry a full 48-byte payload, writing to offset\n42*48=2016 for 48 bytes (ending at byte 2064). The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space. Apply the same fix to the\nhinic driver.", "A flaw was found in the Linux kernel's hinic network driver. An attacker with access to send mailbox messages, such as from a guest operating system utilizing a Virtual Function (VF, a virtualized network interface), can exploit insufficient validation of message segment lengths. This flaw can cause a heap-based buffer overflow, potentially resulting in memory corruption or a Denial of Service (DoS) through a system crash."], "name": "CVE-2026-97957", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97957\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97957\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97957.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c,eca54a092d5f7b497b458ff5a6f66d4f7bfb6674)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c,9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c,513f7b16ed0cffae9348151c72bed17c7073096f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c,5d4d985957434867bbe85e4fa5e638f3e48ad522)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:30:20.154826+00:00", "updated": "2026-10-01T05:30:18.164535+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-119", "CWE-787"]}