CVE-2026-80822
kernel: mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 4, 2026
Updated · October 30, 2026
Description
A flaw was found in the Linux kernel's mailbox: mchp-ipc-sbi component. This vulnerability arises from a missing null check for a memory allocation function. If the memory allocation fails, it can lead to an error condition, potentially causing a denial of service (DoS) where the system becomes unstable or unresponsive.
Statement
This vulnerability is rated with a Moderate severity because triggering the failure requires an exceptional out-of-memory state during device initialization on specialized hardware, leading only to a local denial of service without compromising confidentiality or integrity. Supported Red Hat Enterprise Linux releases do not include the affected Microchip mailbox driver code. Consequently, standard Red Hat enterprise environments are not exposed to this flaw.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference