CVE-2026-90191 Linux CVE debrief

Who should care

Linux kernel developers, maintainers, and users of systems relying on the mailbox subsystem should assess exposure and apply patches or updates as needed to prevent potential buffer overflow or data corruption. They should also verify their Linux kernel versions and configurations to ensure they are not affected by the vulnerability. Additionally, operators and security teams should review the Linux kernel patch provided to understand the changes made to

Why it matters

A vulnerability in the Linux kernel's mailbox subsystem has been addressed. Linux kernel developers, maintainers, and users should assess exposure and apply patches or updates as needed to prevent potential buffer overflow or data corruption.

• Potential buffer overflow or data corruption in mailbox subsystem
• Verification of Linux kernel versions and configurations required
• Patching or updating Linux kernel may be necessary

Technical summary

The Linux kernel's mailbox subsystem, specifically the riscv-sbi-mpxy implementation, did not validate RPMI notification lengths before copying them from shared memory. This could lead to buffer overflow or data corruption. The issue has been resolved by adding validation for notification lengths and proper iteration over event headers. Linux kernel developers and maintainers should assess the exposure of their systems and apply patches or updates as needed to prevent potential buffer overflow or data corruption. The vulnerability has been addressed in the Linux kernel, and users of systems relying on the mailbox subsystem should verify their Linux kernel versions and configurations to ensure they are not

Defensive priority

High

Recommended defensive actions

• Review Linux kernel versions and configurations for exposure
• Verify mailbox subsystem usage and shared memory management
• Apply patches or updates provided by Linux kernel maintainers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the scope of affected systems and potential impact require further verification from official Linux kernel sources. Linux kernel developers and maintainers should verify the mailbox subsystem usage and shared memory management in their deployments. They should also review the Linux kernel patch provided to understand the changes made to address the vulnerability. Additionally, defenders should check relevant monitoring, detection, and logs for exposed

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.