Executive brief
The Linux kernel's RISC-V SBI mailbox driver processes inter-processor messages through a shared memory notification buffer. An attacker or malicious firmware component can exploit insufficient input validation to read or write beyond allocated memory boundaries, potentially leading to privilege escalation, denial of service, or system compromise.
Technical details
A missing validation in the RISC-V SBI mailbox proxy (MPXY) driver allows an unvalidated SBI return value to control the number of bytes copied from shared memory into a RPMI notification buffer without checking against the negotiated shared-memory size. Additionally, the event record walker uses reversed loop logic and can read beyond the copied data. An attacker with local access or control over SBI firmware can craft notifications with oversized lengths to trigger out-of-bounds memory access (read/write). Patch available: commit 11d5af151bcbe78f5a579e0faecd3be9cea0399a adds proper bounds checking and corrects the event iteration logic.
Affected products
- Linux Linux kernel Linux 5.x, 6.x, 7.x (mailbox: RISC-V SBI MPXY driver)
Timeline
- 2026-09-17: disclosed
- 2026-08-14: patched: Fix committed to mainline
- 2026-08-15: other: Fix merged