Linux Kernel up to 7.2.5 cxl cxl_get_feature/cxl_set_feature race condition

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.5 and classified as problematic. The impacted element is the function cxl_get_feature/cxl_set_feature of the component cxl. Executing a manipulation can lead to race condition. The identification of this vulnerability is CVE-2026-93096. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.5. It has been declared as problematic. This vulnerability affects the function cxl_get_feature/cxl_set_feature of the component cxl. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mbox_mutex only serializes individual mailbox commands and is dropped between iterations of these loops. Nothing serializes the multi-part transfer as a whole. cxl_get_feature() and cxl_set_feature() are reachable concurrently from fwctl (per-fd RPCs run under a read-held registration lock) and from the EDAC scrub/ECS/repair paths, so two transfers to the same mailbox can interleave their parts and corrupt the device's transfer context. Add a per-mailbox feat_mutex and hold it across the whole transfer in both functions. It nests outside mbox_mutex (which is taken inside cxl_internal_send_cmd()), and is taken nowhere else, so no lock-ordering inversion is introduced.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-93096 since 09/17/2026. The exploitation appears to be easy. Local access is required to approach this attack. Additional levels of successful authentication are needed for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 7682b617db1f19bc606b5f1badadcf1e63a87b14/77b814c1832fde018c30357b4ec3fcdaa91a1c10 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion