CVE-2026-97957

8.8 HIGH

Published 2026-09-25 · Updated 2026-09-25

AI risk analysis

Summary: This vulnerability allows a buffer overflow in the mailbox segment handling of the hinic driver, leading to potential code execution or data corruption.
Exploitability: Exploitation requires crafting a specific payload that exceeds the buffer size, which is relatively difficult without detailed knowledge of the system configuration.
Blast radius: If exploited, this could lead to unauthorized code execution or data corruption on the affected system, impacting system integrity and confidentiality.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the hinic driver version 3.1.2 or later.

buffer-overflowdriver-vulnerabilitylinux-kernel

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow check_mbox_seq_id_and_seg_len() validates that seq_id does not exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed MBOX_SEG_LEN (48). However, this allows the last segment (seq_id=42) to carry a full 48-byte payload, writing to offset 42*48=2016 for 48 bytes (ending at byte 2064). The receive buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a 16-byte heap buffer overflow. The hinic3 driver already handles this correctly by defining MBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it exceeds the remaining buffer space. Apply the same fix to the hinic driver.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.