CVE-2026-53296: Linux Kernel Mailbox-Test Use-After-Free & Memory Leak (CVSS 7.8)

Technical summary

CVE-2026-53296 is a use-after-free and resource leak vulnerability in the Linux kernel mailbox subsystem, specifically the mailbox-test driver. During device probe, if initialization fails after channels have been obtained via mailbox_request_channel(), the error path does not invoke mailbox_free_channel() for previously acquired channels. The client structure is deallocated via devm_kzalloc(), which triggers automatic cleanup; however, the referenced channels remain unfreed. This creates a two-fold issue: (1) memory leak of mailbox channel structures, and (2) potential use-after-free when code later attempts to interact with the leaked channel pointers. The fix adds explicit channel cleanup in the error handling path before returning failure from probe.

Business impact

For production systems, this vulnerability introduces memory exhaustion and kernel stability risks. Repeated probe failures—whether due to hardware issues, firmware problems, or intentional triggering—can gradually leak kernel memory and degrade system performance. The use-after-free condition, though requiring specific code paths, could enable privilege escalation from a local user context to kernel code execution. Systems relying on the mailbox subsystem for inter-processor communication (common in mobile, IoT, and edge devices) are at higher risk. The impact scales with the number of probe attempts and system uptime.

Affected systems

The vulnerability affects the Linux kernel mailbox-test driver module. This module is typically present on systems with mailbox hardware support, including ARM-based systems, mobile platforms, and specialized embedded systems. The vulnerability exists in kernels prior to the patch commit; the exact affected versions are not specified in the advisory and should be verified against upstream kernel repositories and vendor-specific backport tracking. Systems that do not load the mailbox-test module or lack mailbox hardware are not affected.

Exploitability

Exploitation requires local access and the ability to trigger device probe operations, typically by loading the mailbox-test kernel module or interacting with mailbox hardware that causes driver re-probing. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) indicates low complexity and low privilege requirements, meaning a standard local user can trigger the condition. No user interaction is needed. The practical exploit path depends on the specific system configuration and whether the module is automatically loaded; however, the barrier to triggering the vulnerability is relatively low on systems where users have module-loading privileges or where mailbox hardware can be manipulated.

Remediation

Apply the upstream Linux kernel patch that adds proper channel cleanup in the mailbox-test driver's error handling path. Vendors should backport this fix to all supported kernel branches. Systems should be updated to a kernel version that includes the fix. Interim mitigation on systems that cannot be immediately patched includes disabling the mailbox-test module if not operationally required (it is primarily a diagnostic/test module) via kernel configuration or module blacklisting.

Patch guidance

Update the Linux kernel to a version that includes the fix for CVE-2026-53296. Check your distribution's security advisories and kernel release notes for patched versions. Verify that your kernel configuration includes the fix by examining kernel source commit history or confirming the version number against vendor advisory timelines. After patching, reboot to load the updated kernel. Distributions should prioritize backporting this fix to all actively supported kernel branches.

Detection guidance

Monitor system logs for repeated mailbox-test module probe failures or errors. Use tools like 'dmesg' or kernel log inspection to identify probe error messages. In live systems, tools such as 'kmemleak' can help detect memory leaks, though they require runtime configuration. Check kernel module status with 'lsmod' to verify whether mailbox-test is loaded. Security monitoring should flag any patterns of repeated device probe attempts, as these could indicate an attempt to trigger the vulnerability.

Why prioritize this

Although this vulnerability requires local access and the mailbox-test module is not universally loaded, the combination of use-after-free (CWE-416) and privilege escalation potential warrants high priority. The CVSS score of 7.8 (HIGH) reflects the severe impact—confidentiality, integrity, and availability are all compromised in the context of local user execution. Systems with multi-tenant or untrusted user populations, as well as mobile and embedded platforms where mailbox hardware is common, should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is based on: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and scope unchanged (S:U). The impact ratings are high for confidentiality, integrity, and availability because a local user can achieve kernel code execution through the use-after-free condition, potentially compromising the entire system. The score reflects the practical severity for systems where the mailbox subsystem is active.

Frequently asked questions