CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow
In the Linux kernel, the following vulnerability has been resolved:
net: hinic: fix mailbox segment buffer overflow
checkmboxseqidandseglen() validates that seqid does not exceed SEQIDMAXVAL (42) and seglen does not exceed MBOXSEGLEN (48). However, this allows the last segment (seqid=42) to carry a full 48-byte payload, writing to offset 4248=2016 for 48 bytes (ending at byte 2064). The receive buffer is only MBOXMAXBUFSZ (2048) bytes, resulting in a 16-byte heap buffer overflow.
The hinic3 driver already handles this correctly by defining MBOXLASTSEGMAXLEN and rejecting the last segment when it exceeds the remaining buffer space. Apply the same fix to the hinic driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the mailbox segment-length fix to the hinic driver: reject the last segment when its length exceeds the remaining receive-buffer space, using MBOX_LAST_SEG_MAX_LEN in addition to the MBOX_SEG_LEN (48) limit.
Event History
Frequently Asked Questions
What input triggers the overflow?
A mailbox message with sequence ID 42 and a 48-byte segment triggers the condition. That segment is written at offset 2016 in a 2048-byte receive buffer, overflowing the buffer by 16 bytes.
Which component needs to be present for this issue to apply?
The issue is in the Linux kernel hinic network driver mailbox message handling. Systems not using the hinic driver are not described as affected by the provided information.
What does the fix change?
The fix adds a last-segment length check equivalent to the existing hinic3 driver behavior. It rejects a final mailbox segment when its length exceeds the remaining space in the 2048-byte mailbox receive buffer.