CVE-2026-93096: cxl/features: Serialize multi-part Get/Set Feature transfers
In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Serialize multi-part Get/Set Feature transfers
A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is dropped between iterations of these loops. Nothing serializes the multi-part transfer as a whole. cxlgetfeature() and cxlsetfeature() are reachable concurrently from fwctl (per-fd RPCs run under a read-held registration lock) and from the EDAC scrub/ECS/repair paths, so two transfers to the same mailbox can interleave their parts and corrupt the device's transfer context.
Add a per-mailbox featmutex and hold it across the whole transfer in both functions. It nests outside mboxmutex (which is taken inside cxlinternalsendcmd()), and is taken nowhere else, so no lock-ordering inversion is introduced.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A Get Feature or Set Feature operation must have a payload larger than the mailbox payload size, causing it to be split into multiple mailbox commands. Concurrent multi-part transfers targeting the same mailbox must then interleave.
Which kernel paths can trigger concurrent transfers?
The affected Get/Set Feature functions can be reached through fwctl per-file-descriptor RPCs and through EDAC scrub, ECS, and repair paths. Concurrent activity from these paths can target the same mailbox.
What is the impact of an interleaved transfer?
Interleaving parts from two transfers can corrupt the device's transfer context. The issue is specific to serialization of an entire multi-part feature transfer, rather than serialization of individual mailbox commands.
What change resolves the issue?
The resolution adds a per-mailbox feat_mutex held for the full duration of cxl_get_feature() and cxl_set_feature() multi-part transfers. This lock is taken outside the existing mbox_mutex, which remains acquired within cxl_internal_send_cmd().