CVE-2026-93097: cxl/mbox: Break poison list loop on an empty payload

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

cxl/mbox: Break poison list loop on an empty payload

A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while holding poison.mutex. That hangs the sysfs-triggered scan thread and blocks all subsequent poison operations on the device. The existing "Protect against an uncleared FLAGMORE" guard was intended to bound a misbehaving device but does not cover the count == 0 case.

Stop the loop on an empty payload so a malfunctioning or malicious device cannot wedge the poison scan.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
Description

Frequently Asked Questions

1

What conditions are required to trigger the hang?

A CXL device must repeatedly return a poison-list response with count equal to 0 while keeping CXL_POISON_FLAG_MORE set. This can occur with a malfunctioning or malicious device during a poison-list scan.

2

What is the operational impact if the issue is triggered?

The sysfs-triggered poison scan thread loops indefinitely while holding poison.mutex. Subsequent poison operations for that device are blocked.

3

Are systems without CXL poison-list scanning exposed?

The described hang occurs in the sysfs-triggered poison scan path. The provided information does not identify other affected paths.

4

How can I recognize an affected device or incident?

A poison scan can hang and poison operations on the same device can remain blocked. The triggering device behavior is repeated empty poison-list payloads with the MORE flag set.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203