Skip to main content

Linux Kernel EUVDEUVD-2026-39900

| CVE-2026-53295 MEDIUM
2026-06-26 Linux GHSA-rf57-3w24-v5g9
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger via low-privilege access to mailbox driver path; kernel OOPS impacts only availability with zero confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 04:34 vuln.today
CVSS changed
Jul 08, 2026 - 04:07 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mailbox: add sanity check for channel array

Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers might instantiate very early. Remove the comment explaining the obvious while here.

AnalysisAI

Kernel denial-of-service in the Linux mailbox subsystem triggers an OOPS when a mailbox controller is instantiated without an associated channel array and the code dereferences the missing pointer without a NULL guard. Local low-privileged users on affected systems - particularly embedded or SoC-based Linux deployments that rely on mailbox-based inter-processor communication - can cause a system crash. EPSS is 0.18% (7th percentile), no active exploitation is confirmed, and patches have been backported across all active stable branches from 5.10.x through 7.1.

Technical ContextAI

The Linux kernel mailbox subsystem (drivers/mailbox/) provides a standardized IPC framework between processor cores and hardware accelerators or firmware agents, widely used in ARM-based SoCs (e.g., Qualcomm, Texas Instruments, STMicroelectronics platforms). The root cause is a classic NULL pointer dereference (analogous to CWE-476): a mailbox controller may be registered without an attached channel array, and because these controllers can initialize very early in the boot sequence, the subsequent dereference of the absent array pointer triggers a kernel OOPS before normal error-handling paths are active. The fix introduces a sanity check at registration time to fail gracefully and return early rather than panicking. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The vulnerability is introduced at commit 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c, corresponding to approximately Linux 3.18, and persists through all unpatched stable branches. The EUVD 'Information Disclosure' tag conflicts with the CVSS C:N rating and the CVE description, which describes only availability impact - that tag appears to be a misclassification and should be disregarded.

RemediationAI

Upgrade the Linux kernel to the appropriate patched stable release: 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1, according to the branch in use. Upstream fix commits are available at git.kernel.org (representative commit: https://git.kernel.org/stable/c/5cc3300fab262b26c28bc2fc06df693410c3840b). Distribution vendors (Debian, Ubuntu, Red Hat, SUSE, etc.) are expected to incorporate these stable backports into their respective kernel packages; consult your distribution's security errata. As a compensating control where patching is not immediately feasible, restrict local shell access to systems with mailbox-dependent SoC hardware to trusted users only, reducing the pool of principals who could trigger the vulnerable path - note this does not prevent early-boot hardware-triggered crashes. There are no known protocol or feature-level mitigations that completely neutralize the flaw without patching.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39900 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy