CVE-2026-93096

A flaw was found in the Linux kernel's CXL features. A concurrency vulnerability exists where multi-part Get/Set Feature transfers are not properly serialized. This allows two concurrent transfers to the same mailbox to interleave their parts, which can corrupt the device's transfer context. A local attacker or privileged process could exploit this to cause system instability or a denial of service (DoS).

This vulnerability is classified as Moderate impact because exploitation requires local access on systems equipped with Compute Express Link (CXL) hardware, where concurrent feature mailbox operations can lead to device instability or denial of service. Typical enterprise installations lacking CXL devices or access to device firmware controls are not exposed to this race condition. The flaw cannot be triggered remotely, does not permit unauthorized privilege escalation or data exposure, and older enterprise releases do not contain the vulnerable subsystem code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.