CVE-2026-53296: mailbox: mailbox-test: free channels on probe error

Q: What conditions are required to trigger this issue?

The issue occurs when the mailbox-test driver encounters an error during probe after it has already obtained one or more mailbox channels. The probe failure removes the devm-managed client structure while previously obtained channels remain allocated, creating leak and use-after-free scenarios.

Q: Is this remotely exploitable without local access?

The provided CVSS vector identifies local access, low attack complexity, low privileges, and no user interaction as required. It does not indicate a network-based attack path.

Q: What is the immediate mitigation if an updated kernel cannot be deployed?

The available information identifies the mailbox-test driver's probe-error path as the affected condition. No specific configuration workaround or operational mitigation is provided beyond using a kernel containing the fix.

Q: How can I determine whether a system is affected?

Review whether the running Linux kernel includes the referenced stable commits and whether the mailbox-test driver can be probed in an error condition after acquiring channels. The supplied information does not provide affected or fixed kernel version ranges.

Published Jun 26, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

mailbox: mailbox-test: free channels on probe error

On probe error, free the previously obtained channels. This not only prevents a leak, but also UAF scenarios because the client structure will be removed nonetheless because it was allocated with devm.

Affected Software

9 affected components

Linux Kernel

Linux Linux kernel>=4.4<5.10.258

Linux Linux kernel>=5.11<5.15.209

Linux Linux kernel>=5.16<6.1.175

Linux Linux kernel>=6.2<6.6.141

Linux Linux kernel>=6.7<6.12.91

Linux Linux kernel>=6.13<6.18.33

Linux Linux kernel>=6.19<7.0.10

Linux Linux kernel=7.1-rc1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Operational
In mailbox-test probe error handling, free all previously obtained channels before the client structure is removed, preventing leaks and use-after-free scenarios.

Event History

Jun 26, 2026

CVE Published

via MITRE·07:40 PM

Data Sourced

via MITRE·07:40 PM

Description

Data Sourced

via NVD·08:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What conditions are required to trigger this issue?

The issue occurs when the mailbox-test driver encounters an error during probe after it has already obtained one or more mailbox channels. The probe failure removes the devm-managed client structure while previously obtained channels remain allocated, creating leak and use-after-free scenarios.

Is this remotely exploitable without local access?

The provided CVSS vector identifies local access, low attack complexity, low privileges, and no user interaction as required. It does not indicate a network-based attack path.

What is the immediate mitigation if an updated kernel cannot be deployed?

The available information identifies the mailbox-test driver's probe-error path as the affected condition. No specific configuration workaround or operational mitigation is provided beyond using a kernel containing the fix.

How can I determine whether a system is affected?

Review whether the running Linux kernel includes the referenced stable commits and whether the mailbox-test driver can be probed in an error condition after acquiring channels. The supplied information does not provide affected or fixed kernel version ranges.

CVE-2026-53296: mailbox: mailbox-test: free channels on probe error

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger this issue?

Is this remotely exploitable without local access?

What is the immediate mitigation if an updated kernel cannot be deployed?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger this issue?

Is this remotely exploitable without local access?

What is the immediate mitigation if an updated kernel cannot be deployed?

How can I determine whether a system is affected?