Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-93083

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of a resource after its effective lifetime in mailbox_chan_setup() when requesting an additional unidirectional TX receiver mailbox channel. A local user can initiate mailbox channel setup to cause a denial of service.

The primary mailbox channel remains busy for later probe attempts if the additional channel request fails.

Affected software

How to mitigate CVE-2026-93083

External References

• https://git.kernel.org/stable/c/6f7c06744d53dc8e047725d411d7f915d9ec35ae
• https://git.kernel.org/stable/c/717b8e972a667fc1bebe63cbcf0d58e692cbb491
• https://git.kernel.org/stable/c/9958f55eace8b43713c9fc54dcf90e7cdefee413
• https://git.kernel.org/stable/c/babb017cf5e4600c94c23ea87175a0380235a3ee

Related Security Bulletins

• Missing Release of Resource after Effective Lifetime in Linux kernel arm_scmi transports driver