CVE-2026-97957

A flaw was found in the Linux kernel's hinic network driver. An attacker with access to send mailbox messages, such as from a guest operating system utilizing a Virtual Function (VF, a virtualized network interface), can exploit insufficient validation of message segment lengths. This flaw can cause a heap-based buffer overflow, potentially resulting in memory corruption or a Denial of Service (DoS) through a system crash.

A heap based out of bounds write exists in the HINIC PF mailbox receive path because the segment length validation allows the final mailbox segment to extend beyond the 2048 byte receive buffer. A segment with seq_id 42 can start at offset 2016 and carry 48 bytes, resulting in a write of up to 16 bytes beyond the end of the buffer. A malicious VF may trigger the condition through PF VF mailbox communication. This is relevant when an untrusted guest or tenant controls an assigned virtual function while the vulnerable PF driver runs on the host. For the CVSS the PR:L value is used because reliable triggering requires control of a VF mailbox endpoint, usually through a guest with access to the assigned device or a local process with device administration capability. The guest to host boundary results in Scope Changed. Impact is at least host kernel memory corruption and denial of service. In the worst case the heap overflow may affect confidentiality and integrity or enable privilege escalation, but exploitability depends on allocator layout and the overwritten adjacent object.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.