What’s Vulnerable › Vulnerabilities

CVE-2026-53295: mailbox: add sanity check for channel array

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-26 · updated 2026-10-15

Description

In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers might instantiate very early. Remove the comment explaining the obvious while here.

Affected products

• Linux kernel: from 3.18.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33 — fixed in 5.10.258, 5.15.209, 6.1.175, 6.12.91, 6.18.33, 6.6.141

How to fix

Upgrade to a fixed version: Linux kernel 5.10.258, 5.15.209, 6.1.175, 6.12.91. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0f11444271110d9b5bc6316a153c6431abda899c
• https://git.kernel.org/stable/c/14aed0d4e58389cc6a88acf8610b12d3e476272b
• https://git.kernel.org/stable/c/37792091ab28ba030fd8d61184c47d4d51294170
• https://git.kernel.org/stable/c/5cc3300fab262b26c28bc2fc06df693410c3840b
• https://git.kernel.org/stable/c/6362c4a7d7e21e68cd9aa04df7cde16befba3a4b
• https://git.kernel.org/stable/c/9dd7489943324298bb0f385495795a82f1dd6507
• https://git.kernel.org/stable/c/c1aad75595fb67edc7fda8af249d3b886efa1be9
• https://git.kernel.org/stable/c/d44872a569b8fbacde457ff2587a775e5004bb79
• https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Get alerted when CVE-2026-53295 or the next vulnerability affects your stack