Linux Kernel EUVD-2026-86811

Requires the hinic driver loaded against Huawei HiNIC NIC hardware, and the ability to inject a mailbox segment with seq_id=42 carrying a full 48-byte payload - realistically only reachable via the PF/VF hardware mailbox channel (e.g., a malicious VF in an SR-IOV deployment) or a compromised/malicious device. Limiting factors: local access (AV:L), presence of the specific Huawei NIC and driver, and a non-default SR-IOV configuration for any cross-privilege (VF→PF) impact; overflow is a fixed 16 bytes of mailbox-supplied data, constraining attacker control and favoring a crash over reliable code execution.

The input CVSS 3.1 vector (8.8, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) markedly overstates real-world risk for a NIC-driver mailbox bug. The overflow is a fixed, small (16-byte) heap write past a 2048-byte receive buffer in the hinic mailbox segment reassembler, and the overflowing content is the mailbox segment payload - data that arrives over the device's PF/VF hardware mailbox channel, not an arbitrary user syscall buffer. That means the attacker does not freely control the 16 overflow bytes in the way S:C/C:H/I:H/A:H implies; the realistic outcome is adjacent-slab corruption leading to a crash (DoS). The Scope:Changed rating is plausible only in an SR-IOV context (a malicious VF influencing the PF's mailbox handling), which is a narrow, non-default deployment. No EPSS score, no CISA KEV listing, and no public exploit are present in the intelligence - so this is no public exploit identified at time of analysis. Signals conflict: the vendor-style 8.8 leans toward a high-value memory-corruption LPE, while the description (fixed 16-byte overrun, hardware mailbox source) points to a crash-dominant, low-controllability defect. Treat as a routine kernel-hardening fix, not an urgent priority, absent evidence of exploitability from an untrusted VF.

On a host running the hinic driver for a Huawei HiNIC 100GbE NIC, a crafted mailbox message uses the maximum sequence id (42) together with a full 48-byte segment, driving a write to offset 2016 that runs 16 bytes past the 2048-byte MBOX_MAX_BUF_SZ buffer. In an SR-IOV setup a malicious or compromised VF could attempt to emit such a segment to the PF, corrupting adjacent heap objects and most likely crashing the host kernel. No public proof-of-concept is available.