CVE-2026-9728
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Vulnerability in the userspace syscall verifier z_vrfy_mbox_send() in the mbox driver allows unprivileged threads to bypass access controls and read kernel memory or cause a denial of service via a time-of-check/time-of-use race.
Risk Assessment
An attacker could access sensitive kernel data or cause a system crash, posing a serious threat to confidentiality and availability.
Recommendation
Apply the fix that snapshots the entire mbox_msg structure into kernel memory before validation, and update the system.
Related vulnerabilities
- CVE-2026-6715Critical
IBM Concert 1.0 through 3.0.1.1 allows an attacker to supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.
- CVE-2026-17466Critical
IBM Optim versions 1.0.0, 1.1.0, and 1.2.0 are vulnerable to path traversal, allowing a remote authenticated attacker to obtain sensitive information.
- CVE-2026-15266Critical
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
- CVE-2026-114464Critical
IBM Process Mining 2.0.0 through 2.2.1 has improper access control, which could allow a remote attacker to obtain sensitive information.
- CVE-2026-107331Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 has an absolute-path traversal vulnerability that could allow a remote authenticated attacker to obtain sensitive information.
- CVE-2026-109900Critical
The Melapress Role Editor plugin for WordPress (through version 1.3.0) contains an incorrect privilege assignment vulnerability that allows privilege escalation. A low-privileged user can gain a higher level of access within the system.
- CVE-2026-101117Critical
IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 have an improper Content Security Policy configuration that could allow a remote attacker to bypass security restrictions. The flaw concerns browser-side protection mechanisms.
- CVE-2026-124494Critical
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.
- CVE-2026-124493Critical
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.
- CVE-2026-124490Critical
OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution.
Original NVD description (English source)
The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window. On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint). The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS