CVE-2026-90191 addresses a vulnerability in the Linux kernel's riscv-sbi-mpxy mailbox where the SBI return value controlling the byte count copied from shared memory into the RPMI notification buffer was not validated against the negotiated shared-memory size. This lack of validation could lead to copying more data than intended, potentially causing memory corruption or other impacts. Additionally, the event walker used a reversed loop condition, allowing it to inspect incomplete event records. The fix involves validating the notification length before copying, ensuring iteration only over complete event headers, and stopping when the event payload exceeds the copied notification data.

The vulnerability could allow an attacker with local access to cause memory corruption or other severe impacts due to improper validation of shared memory copy lengths. The CVSS score of 8.4 indicates high severity with high confidentiality, integrity, and availability impact. However, there are no known exploits in the wild at this time.

A fix has been implemented in the Linux kernel to validate RPMI notification lengths properly and correct the event walker loop condition. Users should apply the official kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level issue, updating to a patched kernel version is the recommended mitigation.