CVE-2026-93097

A flaw was found in the Linux kernel's CXL mailbox (cxl/mbox) component. A malicious or malfunctioning device could exploit a vulnerability where an empty payload with a specific flag causes an infinite loop. This issue can lead to a system hang, preventing further poison operations and resulting in a Denial of Service (DoS).

This vulnerability is rated as having a Low impact for Red Hat Enterprise Linux because exploitation requires physically or virtually attaching a malfunctioning or untrusted CXL hardware device, limiting the blast radius to a denial of service on that device's telemetry operations. Under typical enterprise deployments, CXL-enabled memory or accelerator hardware is not commonly present, and standard unprivileged users cannot trigger hardware-level mailbox responses. If triggered, the issue locks the sysfs inspection thread responsible for reading poison records, which stalls further poison list queries on the device without causing a full kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.