CVE-2026-90191

A flaw was found in the Linux kernel's mailbox: riscv-sbi-mpxy component. This vulnerability arises from insufficient validation of the SBI (System Binary Interface) return value, which dictates the number of bytes copied from shared memory into the RPMI (RISC-V Platform Management Interface) notification buffer. An attacker could exploit this by providing a malformed notification length, leading to memory corruption. This could result in information disclosure, system instability, or a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.