« Volver al listado

CVE-2026-97957

Estado: RecibidaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

net: hinic: fix mailbox segment buffer overflow

check_mbox_seq_id_and_seg_len() validates that seq_id does not exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed MBOX_SEG_LEN (48). However, this allows the last segment (seq_id=42) to carry a full 48-byte payload, writing to offset 42*48=2016 for 48 bytes (ending at byte 2064). The receive buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a 16-byte heap buffer overflow.

The hinic3 driver already handles this correctly by defining MBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it exceeds the remaining buffer space. Apply the same fix to the hinic driver.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Buffer overflow en código kernel local (AV:L, PR:L) permite lectura/corrupción de memoria y denegación de servicio. Escalada de privilegios por desbordamiento de pila.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-97957",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "lessThan": "7cc974799fde846eda2d8f00ad4f8e1810eb0499",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "lessThan": "8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "lessThan": "72be1fd5d256dde748c0905c5e1749a119cad5bd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "lessThan": "c622bbc212207d7c6bbd69dd88f0c3a3f5853d16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "lessThan": "eca54a092d5f7b497b458ff5a6f66d4f7bfb6674",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "lessThan": "9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "lessThan": "513f7b16ed0cffae9348151c72bed17c7073096f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "lessThan": "5d4d985957434867bbe85e4fa5e638f3e48ad522",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:23.367",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/513f7b16ed0cffae9348151c72bed17c7073096f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5d4d985957434867bbe85e4fa5e638f3e48ad522",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/72be1fd5d256dde748c0905c5e1749a119cad5bd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7cc974799fde846eda2d8f00ad4f8e1810eb0499",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c622bbc212207d7c6bbd69dd88f0c3a3f5853d16",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eca54a092d5f7b497b458ff5a6f66d4f7bfb6674",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48).  However, this allows the last segment\n(seq_id=42) to carry a full 48-byte payload, writing to offset\n42*48=2016 for 48 bytes (ending at byte 2064).  The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space.  Apply the same fix to the\nhinic driver."
    }
  ],
  "lastModified": "2026-10-03T11:18:20.720",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}