CVE-2026-97957 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
net: hinic: fix mailbox segment buffer overflow
check_mbox_seq_id_and_seg_len() validates that seq_id does not exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed MBOX_SEG_LEN (48). However, this allows the last segment (seq_id=42) to carry a full 48-byte payload, writing to offset 42*48=2016 for 48 bytes (ending at byte 2064). The receive buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a 16-byte heap buffer overflow.
The hinic3 driver already handles this correctly by defining MBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it exceeds the remaining buffer space. Apply the same fix to the hinic driver.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel network subsystem contains a critical memory safety vulnerability within the hinic hardware interface driver, specifically involving improper validation of mailbox message segments during communication with associated firmware or hardware components. This flaw manifests as a heap-based buffer overflow that arises from an off-by-one logic error in the sequence identifier and segment length checks. The function check_mbox_seq_id_and_seg_len is responsible for validating incoming messages to ensure they fit within predefined memory boundaries, but its implementation fails to account for the cumulative size of all preceding segments when evaluating the final message portion. This oversight allows a malicious or malformed input to write beyond the allocated buffer limits, potentially leading to arbitrary code execution, kernel panic, or privilege escalation depending on the context in which the driver operates and what data resides adjacent to the affected memory region.
The technical root cause lies in the arithmetic calculation used to determine if the incoming segment fits into the remaining receive buffer space. The validation logic checks that the sequence identifier does not exceed SEQ_ID_MAX_VAL, set at 42, and that the individual segment length does not exceed MBOX_SEG_LEN, defined as 48 bytes. While these constraints appear restrictive on their own, they do not consider the cumulative offset of previous segments in a multi-segment message structure. When processing the last allowed segment with sequence ID equal to forty-two, the code calculates the starting write position by multiplying the sequence ID by the maximum segment length, resulting in an offset of two thousand sixteen bytes. Adding the full forty-eight-byte payload for this final segment pushes the memory write operation up to byte number twenty sixty-four. However, the total size of the receive buffer is strictly limited to MBOX_MAX_BUF_SZ, which equals two thousand forty-eight bytes. Consequently, any attempt to process a complete last segment results in writing sixteen bytes past the end of the allocated heap memory block.
This vulnerability aligns with Common Weakness Enumeration category CWE-120, Buffer Copy without Checking Size of Input, and more specifically reflects issues related to improper boundary checks often categorized under CWE-787 Out-of-bounds Write. In terms of attack vector classification within the MITRE ATT&CK framework, this flaw could be exploited by an attacker who can inject crafted network packets or interact with the device through local interfaces that trigger mailbox communication sequences. By carefully crafting a sequence of messages culminating in a full-sized final segment, an adversary might achieve out-of-bounds memory writes. Such exploits are particularly dangerous because heap overflows allow attackers to corrupt adjacent data structures, potentially hijacking control flow by overwriting function pointers or object metadata stored nearby in the heap layout.
The operational impact of this vulnerability is significant for systems relying on hinic network adapters for high-performance computing or critical infrastructure networking tasks. Successful exploitation could lead to denial of service through kernel crashes caused by memory corruption violations detected by security mechanisms like KASAN or SLUB debugging features. More severely, if an attacker can control the content written beyond the buffer boundary, they may execute arbitrary code with the privileges of the kernel process handling network interrupts or driver operations. This represents a serious threat to system integrity and confidentiality, especially in environments where virtualization or containerized workloads share host resources managed by these drivers.
To mitigate this risk, developers have applied a fix that mirrors the logic already present in the hinic3 variant of the same driver family. The corrected implementation introduces a new constant named MBOX_LAST_SEG_MAX_LEN and modifies the validation routine to reject any last segment whose length exceeds the remaining space available in the receive buffer after accounting for all prior segments. This ensures that no write operation can ever exceed the physical limits of MBOX_MAX_BUF_SZ. System administrators should prioritize updating their kernel packages to include this patch, particularly if they utilize hardware accelerated networking features provided by hinic adapters. Additionally, enabling runtime memory error detection tools during development and testing phases helps identify similar logical flaws before deployment in production environments where such vulnerabilities pose unacceptable risks to stability and security posture.