CVE-2026-53294: Linux Kernel Mailbox-Test Double-Free Vulnerability

Technical summary

CVE-2026-53294 is a double-free vulnerability (CWE-415) in the Linux kernel mailbox-test driver. The issue occurs in channel resource cleanup when the RX (receive) channel is aliased to the TX (transmit) channel due to differing MMIO (Memory-Mapped I/O) configurations. The driver's deallocation logic lacks a check to detect this aliasing condition, resulting in a double-free of the same channel resource during shutdown or module unload. The vulnerability requires local system access and standard user privileges to trigger.

Business impact

This vulnerability can cause unexpected kernel crashes or system hangs when the mailbox-test module is unloaded or channels are freed. In production environments using mailbox communication subsystems, exploitation could lead to denial of service conditions, service interruptions, or system instability. The impact is primarily operational rather than concerning confidentiality or integrity of data, though the high CVSS score reflects the ability to trigger complete system disruption.

Affected systems

The Linux kernel is affected, specifically the mailbox-test subsystem used for testing and validating mailbox drivers. Exposure is limited to systems with: the mailbox-test module loaded or compiled in, local system access, and mailbox hardware configurations where RX and TX channels share the same MMIO address space. Typical affected deployments include kernel development systems, test environments, and some embedded or SoC-based Linux deployments using mailbox communication hardware.

Exploitability

The vulnerability requires local system access and unprivileged user privileges to trigger. No network vector is present. Exploitation is straightforward once local access is obtained—simply unloading the mailbox-test module or forcing channel cleanup can induce the double-free. No special exploit code is needed; the condition is triggered through normal module lifecycle operations. The CVSS score of 7.8 reflects the ease of triggering combined with the high-severity impact on system stability.

Remediation

The fix involves adding a conditional check in the channel cleanup code to verify whether the RX channel is aliased to the TX channel before attempting to free it separately. When aliasing is detected, the RX channel should not be freed independently, as it shares the same underlying resource. Verify the exact patch version and implementation details against the official Linux kernel security advisory and your distribution's kernel patch repository.

Patch guidance

Consult your Linux distribution's security advisories for patched kernel versions. Mainline kernel users should update to a version that includes the mailbox-test double-free fix. Check your vendor's kernel release notes or security bulletins for the specific version containing the resolution. If patching is delayed, consider disabling the mailbox-test module if it is not required for your system's operation.

Detection guidance

Monitor kernel logs and system error messages for double-free warnings or page fault errors originating from the mailbox subsystem, particularly during module load/unload cycles. Kernel debugging tools and KASAN (Kernel Address Sanitizer) can detect the double-free if the kernel is compiled with sanitizer support. Systems showing unexpected crashes or hangs during mailbox-test module operations should be examined for this vulnerability. Review running processes and loaded modules to confirm whether mailbox-test is active in your environment.

Why prioritize this

Although the vulnerability does not appear on the CISA KEV catalog and requires local system access, it merits prompt attention in environments where the mailbox-test module is actively used or where local user access is permitted. The high CVSS score (7.8) and the severity of kernel stability impact make this a moderate to high priority for systems running affected kernel versions. Organizations should prioritize patches for systems where local attackers could trigger denial of service.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a vulnerability with low attack complexity and no privilege escalation required—standard users can trigger it with local access. The impact vector shows high severity across confidentiality, integrity, and availability, with the availability impact being the primary concern due to kernel crash potential. The local attack vector (AV:L) and required user-level privileges (PR:L) prevent a perfect score, but the ease of exploitation and system-wide impact justify the high rating.

Frequently asked questions