UBUNTU-CVE-2026-93096: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is dropped between iterations of these loops. Nothing serializes the multi-part transfer as a whole. cxlgetfeature() and cxlsetfeature() are reachable concurrently from fwctl (per-fd RPCs run under a read-held registration lock) and from the EDAC scrub/ECS/repair paths, so two transfers to the same mailbox can interleave their parts and corrupt the device's transfer context. Add a per-mailbox featmutex and hold it across the whole transfer in both functions. It nests outside mboxmutex (which is taken inside cxlinternalsendcmd()), and is taken nowhere else, so no lock-ordering inversion is introduced.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a per-mailbox feat_mutex and hold it across the whole multi-part transfer in both cxl_get_feature() and cxl_set_feature().
Linux kernel CXL mailbox feature transfers feat_mutex = per-mailbox mutex held across the entire transfer