CVE-2026-97957

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net: hinic: fix mailbox segment buffer overflow

check_mbox_seq_id_and_seg_len() validates that seq_id does not exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed MBOX_SEG_LEN (48). However, this allows the last segment (seq_id=42) to carry a full 48-byte payload, writing to offset 42*48=2016 for 48 bytes (ending at byte 2064). The receive buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a 16-byte heap buffer overflow.

The hinic3 driver already handles this correctly by defining MBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it exceeds the remaining buffer space. Apply the same fix to the hinic driver.

Affected product:

AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Debian 11 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU

Affected packages:

kernel @ 5.10.0 (+4 more)

Live-patch status from KernelCare for each operating system.