Linux Kernel CVE-2026-53295

The Linux kernel mailbox subsystem (drivers/mailbox/) provides a standardized IPC framework between processor cores and hardware accelerators or firmware agents, widely used in ARM-based SoCs (e.g., Qualcomm, Texas Instruments, STMicroelectronics platforms). The root cause is a classic NULL pointer dereference (analogous to CWE-476): a mailbox controller may be registered without an attached channel array, and because these controllers can initialize very early in the boot sequence, the subsequent dereference of the absent array pointer triggers a kernel OOPS before normal error-handling paths are active. The fix introduces a sanity check at registration time to fail gracefully and return early rather than panicking. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The vulnerability is introduced at commit 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, corresponding to approximately Linux 3.18, and persists through all unpatched stable branches. The EUVD 'Information Disclosure' tag conflicts with the CVSS C:N rating and the CVE description, which describes only availability impact - that tag appears to be a misclassification and should be disregarded.