Threats Tagged 'cve-2026-90191'

A high-severity vulnerability in the Linux kernel's riscv-sbi-mpxy mailbox component involves improper validation of RPMI notification lengths. The SBI return value, which dictates how many bytes are copied from shared memory into the RPMI notification buffer, was not validated against the negotiated shared-memory size, leading to potential memory corruption. The event walker also had a reversed loop condition, allowing inspection of short event records improperly. The vulnerability has been resolved by validating the complete notification length before copying, iterating only while a full event header remains, and stopping when the event payload extends beyond the copied data.