---
id: CVE-2026-53295
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mailbox: add sanity check for channel array

  Fail gracefully if there is no channel array attached to the mailbox
  controller
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mailbox: add sanity check for channel array

  Fail gracefully if there is no channel array attached to the mailbox
  controller. Otherwise the later dereference will cause…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.18.1, < 5.10.258'
  - 'linux_kernel >= 5.11, < 5.15.209'
  - 'linux_kernel >= 5.16, < 6.1.175'
  - 'linux_kernel >= 6.2, < 6.6.141'
  - 'linux_kernel >= 6.7, < 6.12.91'
  - 'linux_kernel >= 6.13, < 6.18.33'
  - 'linux_kernel >= 6.19, < 7.0.10'
  - linux_kernel = 3.18
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.10
published: '2026-06-26'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T09:18:15.920'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53295'
references:
  - url: 'https://git.kernel.org/stable/c/0f11444271110d9b5bc6316a153c6431abda899c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/14aed0d4e58389cc6a88acf8610b12d3e476272b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/37792091ab28ba030fd8d61184c47d4d51294170'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5cc3300fab262b26c28bc2fc06df693410c3840b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6362c4a7d7e21e68cd9aa04df7cde16befba3a4b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9dd7489943324298bb0f385495795a82f1dd6507'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c1aad75595fb67edc7fda8af249d3b886efa1be9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d44872a569b8fbacde457ff2587a775e5004bb79'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00166
epssPercentile: 0.05163
ingestedAt: '2026-09-08T15:33:26.945Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mailbox: add sanity check for channel array

Fail gracefully if there is no channel array attached to the mailbox
controller. Otherwise the later dereference will cause an OOPS which
might not be seen because mailbox controllers might instantiate very
early. Remove the comment explaining the obvious while here.

## Affected

- `linux_kernel >= 3.18.1, < 5.10.258`
- `linux_kernel >= 5.11, < 5.15.209`
- `linux_kernel >= 5.16, < 6.1.175`
- `linux_kernel >= 6.2, < 6.6.141`
- `linux_kernel >= 6.7, < 6.12.91`
- `linux_kernel >= 6.13, < 6.18.33`
- `linux_kernel >= 6.19, < 7.0.10`
- `linux_kernel = 3.18`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.10`