Executive brief
The Linux kernel's CXL (Compute Express Link) memory device driver contains a race condition in how it handles large feature configuration requests that span multiple mailbox commands. When two processes attempt to configure CXL device features simultaneously, their operations can interleave and corrupt the device's internal transfer state, potentially causing the device to malfunction or fail to execute commands correctly.
Technical details
The vulnerability is a race condition (CWE-362) in the CXL mailbox driver's Get/Set Feature implementation. When a feature payload exceeds the mailbox payload size, it is split across multiple mailbox commands. The existing mbox_mutex only protects individual commands and is released between loop iterations, leaving the entire multi-part transfer unserialized. The cxl_get_feature() and cxl_set_feature() functions are reachable concurrently from fwctl user-space RPC handlers and from EDAC (Error Detection and Correction) kernel subsystem paths, allowing two transfers to the same mailbox to interleave their parts and corrupt device state. The fix adds a per-mailbox feat_mutex that serializes entire multi-part transfers while nesting safely outside the existing mbox_mutex, preventing interleaving without introducing deadlock.
Affected products
- Linux Linux kernel Affected versions include kernels with CXL feature support (approximately 5.15+); patched in mainline and stable trees via commit 77b814c1832fde018c30357b4ec3fcdaa91a1c10
Timeline
- 2026-07-09: disclosed: Original fix authored by Dave Jiang
- 2026-07-14: patched: Commit 77b814c1832fde018c30357b4ec3fcdaa91a1c10 merged to mainline
- 2026-09-17: advisory: CVE-2026-93096 published