Executive brief
A vulnerability was identified in the Linux kernel's mailbox testing driver where system resources were not properly released during a failed initialization. This could lead to a 'use-after-free' condition, potentially causing system instability or a crash. While primarily affecting testing environments, it represents a flaw in how the kernel manages hardware communication channels.
Technical details
A vulnerability in `drivers/mailbox/mailbox-test.c` in the Linux kernel occurs when the `mbox_test_probe` function fails. If an error occurs after mailbox channels have been allocated (e.g., a memory allocation failure for `rx_buffer` or a `debugfs` registration failure), the driver fails to call `mbox_free_channel`. Because the underlying client structure is managed via `devm`, it is freed automatically on probe failure, but the mailbox framework may still hold references to the now-freed structure through the unreleased channels. This results in a use-after-free (UAF) condition. The fix introduces an error handling path that explicitly frees the TX and RX channels before returning.
Affected products
- Linux Linux 4.4 to 6.13
Timeline
- 2026-04-10: other: Patch authored
- 2026-06-26: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/02beb178e2e159daeb8f992d7abb16a37da31664
- https://git.kernel.org/stable/c/0ad8c4a03a358de7811ba1ab8cbd1fe76ad0ff6b
- https://git.kernel.org/stable/c/15c4cc3850cfe1b973eb7b63c02314b267f06a64
- https://git.kernel.org/stable/c/187069ccc3474516af32350e20d7e449160fa6de
- https://git.kernel.org/stable/c/6c6ce2ccb4fcf1617fec83f91b21aa0265f30701
- https://git.kernel.org/stable/c/742001919653e7313b4e91780c5d108be1692365
- https://git.kernel.org/stable/c/81c9e7e4030e71391ab479c4c6e17b64802577aa