{"id":"CVE-2026-90191","published":"2026-09-17T17:17:13.810","lastModified":"2026-09-18T18:17:45.823","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: riscv-sbi-mpxy: validate RPMI notification lengths\n\nThe SBI return value controls how many bytes are copied from shared\nmemory into the RPMI notification buffer. It is not validated against\nthe negotiated shared-memory size before that copy. The event walker\nalso uses a reversed loop condition and can inspect a short event record.\n\nValidate the complete notification length before copying it, iterate only\nwhile a full event header remains, and stop when a declared event payload\nextends beyond the copied notification data.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/11d5af151bcbe78f5a579e0faecd3be9cea0399a","tags":[]},{"url":"https://git.kernel.org/stable/c/c7bc5e7677bcda7a446d63b989cfaa3fe91d6b76","tags":[]},{"url":"https://git.kernel.org/stable/c/cbc24bce70dfd91c7b2f53b4fa896e9a4b6d6a6b","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}