---
id: CVE-2026-93096
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cxl/features: Serialize multi-part Get/Set Feature transfers

  A Get or Set Feature payload larger than the mailbox payload size is
  split into several mailbox commands
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cxl/features: Serialize multi-part Get/Set Feature transfers

  A Get or Set Feature payload larger than the mailbox payload size is
  split into several mailbox commands. …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5e5ac21f629de796ab5d598b59c5e468c6fe4f95 <
    7682b617db1f19bc606b5f1badadcf1e63a87b14
  - >-
    Linux >= 5e5ac21f629de796ab5d598b59c5e468c6fe4f95 <
    77b814c1832fde018c30357b4ec3fcdaa91a1c10
  - Linux 6.15
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:03.713'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93096'
references:
  - url: 'https://git.kernel.org/stable/c/7682b617db1f19bc606b5f1badadcf1e63a87b14'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/77b814c1832fde018c30357b4ec3fcdaa91a1c10'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.758Z'
epss: 0.00189
epssPercentile: 0.08817
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cxl/features: Serialize multi-part Get/Set Feature transfers

A Get or Set Feature payload larger than the mailbox payload size is
split into several mailbox commands. mbox_mutex only serializes
individual mailbox commands and is dropped between iterations of these
loops. Nothing serializes the multi-part transfer as a whole.
cxl_get_feature() and cxl_set_feature() are reachable concurrently
from fwctl (per-fd RPCs run under a read-held registration lock) and
from the EDAC scrub/ECS/repair paths, so two transfers to the same
mailbox can interleave their parts and corrupt the device's transfer
context.

Add a per-mailbox feat_mutex and hold it across the whole transfer in
both functions. It nests outside mbox_mutex (which is taken inside
cxl_internal_send_cmd()), and is taken nowhere else, so no lock-ordering
inversion is introduced.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.