CVE-2026-90191 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory size before that copy. The event walker also uses a reversed loop condition and can inspect a short event record.
Validate the complete notification length before copying it, iterate only while a full event header remains, and stop when a declared event payload extends beyond the copied notification data.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's RISC-V SBI multiplexed mailbox driver contains a critical input validation flaw that exposes systems to potential buffer overflows and out-of-bounds memory access vulnerabilities. This issue stems from an insufficient verification of data lengths provided by external firmware interfaces, specifically within the RPMI notification handling logic. The vulnerability arises because the system relies on return values from SBI calls to determine how many bytes should be copied from shared memory into a local notification buffer without first verifying that this requested length is consistent with the size of the negotiated shared-memory region. This lack of boundary checking creates a scenario where malicious or malformed firmware could instruct the kernel to copy more data than allocated, leading to heap corruption or arbitrary code execution if an attacker can influence the SBI return value through compromised hardware interfaces or virtualization layers.
The technical root cause involves two distinct but related implementation errors within the event processing loop. First, the driver fails to validate that the total notification length does not exceed the pre-negotiated shared memory size before initiating the copy operation. Second, the internal event walker utilizes a reversed loop condition that allows it to inspect incomplete or short event records rather than ensuring each record is fully formed and valid within the buffer boundaries. This logic error means that even if some data is copied safely, the subsequent parsing phase may read beyond the intended limits of individual events, potentially accessing uninitialized memory or adjacent kernel structures. These flaws collectively undermine the integrity of the inter-processor communication mechanism used by RISC-V systems to manage hardware notifications and power management requests.
From an operational perspective, this vulnerability poses a significant risk to system stability and security on affected platforms. An attacker with the ability to manipulate SBI calls, such as through a compromised hypervisor in virtualized environments or via physical access allowing for firmware tampering, could exploit these flaws to crash the kernel by triggering a general protection fault or page fault due to invalid memory accesses. In more severe scenarios involving controlled heap layouts and specific exploitation techniques, this could lead to privilege escalation from user space or lower-privileged domains to ring 0 kernel privileges. The impact is particularly acute in multi-core RISC-V systems where efficient inter-processor communication via the mailbox interface is critical for performance and power management, making any disruption potentially catastrophic for system availability.
To mitigate these risks, it is imperative that developers enforce strict length validation before performing memory copies from shared regions into kernel buffers. The fix involves validating the complete notification length against the negotiated shared-memory size to ensure no overflow occurs during data transfer. Additionally, the event walker logic must be corrected to iterate only while a full event header remains within the buffer boundaries and to terminate processing immediately if any declared event payload extends beyond the copied notification data. These changes align with fundamental secure coding principles regarding input validation and boundary checking. The vulnerability is categorized under CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and relates to ATT&CK technique T1498 Network Effect: Denial of Service, as it can be leveraged to cause system crashes or instability through malformed inputs from trusted but potentially compromised hardware interfaces.