SB20260918123 - Race condition in Linux kernel cxl

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-93096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt the device's transfer context.

The vulnerability exists due to a race condition in cxl_get_feature() and cxl_set_feature() when concurrent multi-part Get or Set Feature transfers are processed. A local user can issue concurrent feature requests to corrupt the device's transfer context.

The issue affects transfers whose payloads exceed the mailbox payload size.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7682b617db1f19bc606b5f1badadcf1e63a87b14
• https://git.kernel.org/stable/c/77b814c1832fde018c30357b4ec3fcdaa91a1c10