CVE-2026-97957

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97957
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-97957.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-97957
Downstream
Related
Published
2026-09-25T10:23:03Z
Modified
2026-10-09T17:27:02Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
net: hinic: fix mailbox segment buffer overflow
Details

In the Linux kernel, the following vulnerability has been resolved:

net: hinic: fix mailbox segment buffer overflow

check_mbox_seq_id_and_seg_len() validates that seq_id does not exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed MBOX_SEG_LEN (48). However, this allows the last segment (seq_id=42) to carry a full 48-byte payload, writing to offset 42*48=2016 for 48 bytes (ending at byte 2064). The receive buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a 16-byte heap buffer overflow.

The hinic3 driver already handles this correctly by defining MBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it exceeds the remaining buffer space. Apply the same fix to the hinic driver.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97957.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c
Fixed
7cc974799fde846eda2d8f00ad4f8e1810eb0499
Fixed
8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920
Fixed
72be1fd5d256dde748c0905c5e1749a119cad5bd
Fixed
c622bbc212207d7c6bbd69dd88f0c3a3f5853d16
Fixed
eca54a092d5f7b497b458ff5a6f66d4f7bfb6674
Fixed
9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5
Fixed
513f7b16ed0cffae9348151c72bed17c7073096f
Fixed
5d4d985957434867bbe85e4fa5e638f3e48ad522

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-97957.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.8.0
Fixed
5.10.271
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-97957.json"