Executive brief
A vulnerability in the Linux kernel's mailbox testing component could allow a local attacker to cause a system crash. The issue occurs when the system incorrectly attempts to release the same communication channel twice during cleanup. This could lead to a denial-of-service condition, impacting the availability of the affected system.
Technical details
A double-free vulnerability exists in drivers/mailbox/mailbox-test.c within the Linux kernel. The root cause is an improper check during the cleanup phase in both mbox_test_probe (error path) and mbox_test_remove. When the RX channel is aliased to the TX channel (sharing the same channel object but potentially different MMIO), the code calls mbox_free_channel on both pointers without verifying if they point to the same resource. An attacker with sufficient privileges to trigger driver probing or removal could exploit this to cause memory corruption or a kernel panic. The issue has been resolved by adding a check to ensure the RX channel is only freed if it is distinct from the TX channel.
Affected products
- Linux Linux 4.4 to 6.6.141, 6.1.175, 5.15.209, 5.10.258
Timeline
- 2026-06-26: disclosed: CVE published by kernel.org
- 2026-05-23: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/240c71a2aea36a1a4210f911a1c32ea88777e8e4
- https://git.kernel.org/stable/c/3afca89fae501dbd7421e1777b5b8f033b1d98d0
- https://git.kernel.org/stable/c/5c209299b0113e289e238fa5f2e8f00c59f76060
- https://git.kernel.org/stable/c/5d4f3d0f64f1016cb78b400a70b67df91fac99b5
- https://git.kernel.org/stable/c/82f6dcea46cf5de65c4ba7283f7c7b34de4a324d
- https://git.kernel.org/stable/c/88ebadbf0deefdaccdab868b44ff70a0a257f473
- https://git.kernel.org/stable/c/c494a11da45ad7ec9b0ff216c3e3ace351193bb6