EUVD-2026-39901
GHSA-h624-59g3-97r5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector; triggering a probe-error UAF needs module-load/hardware-binding control (PR:H) and a race-like error path (AC:H), but successful exploitation yields full kernel compromise (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
mailbox: mailbox-test: free channels on probe error
On probe error, free the previously obtained channels. This not only prevents a leak, but also UAF scenarios because the client structure will be removed nonetheless because it was allocated with devm.
AnalysisAI
Use-after-free in the Linux kernel's mailbox-test debug driver (mailbox-test.c) allows a local privileged attacker to corrupt kernel memory when the driver's probe routine fails, because previously acquired mailbox channels are not released while the devm-allocated client structure is freed anyway. The flaw carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact, but exploitation is local and requires the mailbox-test module to load and hit a probe error path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a kernel built with the mailbox-test driver (CONFIG_MAILBOX_TEST) present and loaded, and (2) the driver's probe routine hitting an error path after it has already obtained mailbox channels - for example due to a malformed or partially-satisfiable device-tree/ACPI mailbox binding. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this 7.8 High, but all real-world signals point to modest priority: EPSS is 0.18% (7th percentile), the CVE is not on CISA KEV, and no POC is known. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with the privileges needed to load kernel modules or influence mailbox device binding causes the mailbox-test driver to fail during probe after it has already acquired one or more channels; the freed devm-managed client is then referenced through the still-registered channel, yielding a use-after-free the attacker grooms toward kernel memory corruption and privilege escalation. Because the CVSS vector is AV:L/AC:L, exploitation is low-complexity but requires local access, and no public proof-of-concept is currently known. |
| Remediation | Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 or later, per your maintained branch, applying the commits at https://git.kernel.org/stable/c/6c6ce2ccb4fcf1617fec83f91b21aa0265f30701 and the sibling backports. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit your Linux systems to identify which hosts have the mailbox-test module loaded (lsmod | grep mailbox_test) and determine whether the module is required for production. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today